Archive Debian Forums - User contributions [en]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2026-04-04T01:05:14Z

Blackcat568: /* Main Aspects of System Hardening */

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.
* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

''Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build).''

Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

====== Main Aspects of System Hardening ======

1. Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.

2. If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to use long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>

3. Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.

4. Avoid using the superuser account or ''sudo'' without a clear necessity — and never execute arbitrary scripts with ''sudo''. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
* Always read a script fully before running it (less script.sh, cat script.sh).
* Never paste commands from untrusted or unverified sources into the terminal.
* Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
* Follow the principle of least privilege — create separate user accounts and limit access rights where possible <blockquote>'''Important:''' Improper or careless use of ''sudo'' and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.</blockquote>

5. Follow a server-style access model

Do not add regular users to the ''sudo'' group. The ''sudo'' privilege should be reserved exclusively for the superuser (root). Regular users '''should not''' have the ability to execute commands as root via ''sudo''.

Yes, this can introduce some inconvenience in system administration, but this model provides a more secure configuration and reduces the risk of accidental or intentional security breaches.<blockquote>'''Note:''' system users created by the kernel or services (e.g., ''www-data'', ''postgres,'' ''nobody'') '''do not have sudo access by default'''. Programs installed using ''sudo'' by the root user '''do not automatically grant sudo privileges to users created by those programs'''. Any virtual or service accounts remain unable to run commands with ''sudo'' unless explicitly added to the sudo-enabled group.</blockquote>

6. Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. If you have difficulty configuring AppArmor, seek help from specialists or use AI-based tools.

The use of mandatory access control mechanisms represents an important layer of system protection. Without proper configuration, even a system with a correctly configured firewall may remain vulnerable to various types of attacks.<blockquote>'''Warning:''' AppArmor, SELinux and other Mandatory Access Control (MAC) mechanisms may cause system malfunction if misconfigured. Errors in profiles or policies can result in service failures, boot issues, user session lockout, or restricted access to system resources. In some cases, system recovery may be difficult even when using recovery mode, a chroot environment, or booting from a Live/Rescue medium.
</blockquote>

It is recommended to perform testing and development of complex and/or custom policies and profiles in an isolated environment (for example, in a virtual machine). It is advisable to retain change logs and terminal output for subsequent analysis.

Configuration changes should be applied to the host system '''only after confirming correct and stable operation in the test environment.'''

Additional recommendations:

* When restricting potentially vulnerable system services and daemons, use AppArmor profiles with the minimum required permissions (principle of least privilege).
* For potentially vulnerable user applications (browsers, messengers, database managers), prioritize isolation using sandboxing solutions (e.g., Flatpak, Firejail). Use AppArmor as an additional layer or in cases where sandboxing is not available.
* This approach creates an architecture where applications are isolated from each other and from the system. In the event that a sandboxed application is compromised, its access to other applications and the system as a whole will be maximally restricted, which significantly hinders further actions by an attacker.

7. Use advanced network filtering settings: iptables or nftables, or a commercial firewall.

In addition to blocking all unnecessary incoming connections (on most home workstations, you can block all incoming traffic), be sure to also restrict outgoing connections — block all ports and ranges that are not required by the system and applications. This reduces the attack surface.

My nftables config can be viewed [https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/SecurityConfigsAndLogs#| here].

In addition to iptables/nftables, it is strongly recommended to use [https://www.tecmint.com/opensnitch-linux-application-firewall/| OpenSnitch] — '''an interactive firewall''' that shows in real time the IP, process, PID, and port for each connection. OpenSnitch allows you to flexibly block suspicious activity, which, combined with nftables, provides significantly more robust protection.

OpenSnitch operates on top of nftables/iptables. Instead of merely showing "traffic on a port," it reveals exactly which process is trying to connect to where. The project is not widely known, yet it is extremely useful, actively developed, and deserves the community's attention and support.

8. Configure kernel parameters for maximum security (sysctl hardening).
My 99-protect.conf config can be viewed [https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/SecurityConfigsAndLogs#| here].

<blockquote>
Master the syntax and policies of nftables, AppArmor, and sysctl. These are native Linux kernel mechanisms for traffic filtering, mandatory access control (MAC), and system parameter restrictions. Deep proficiency in configuring them is critically useful for building secure systems.
</blockquote>

9. Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event).
My auditd config can be viewed [https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/SecurityConfigsAndLogs#| here].

10. Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.

11 If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.

12. Follow the principle of Attack Surface Reduction (or [https://en.wikipedia.org/wiki/Occam's_razor Occam's Razor]) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
* If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
* If you are certain you will never use it, remove it completely from the system.
* This practice reduces potential attack vectors and strengthens overall system security.
* Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications.
* Always create a full system backup before making any significant configuration changes or modifications.

13. Perform regular antivirus and anti-rootkit scans of the system.

In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.

14. Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:

<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>

Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

15. Use desktop environments based on Wayland.

Wayland is a modern display server protocol that provides stronger application isolation. Unlike Xorg, where any client application can potentially intercept input (keyboard, mouse) and observe other windows, Wayland implements a model in which applications do not have direct access to each other or to global input; all input handling is mediated by the compositor.

This significantly reduces the impact of a single application compromise: even if an application is exploited, it cannot transparently monitor user activity in other programs.

Wayland is supported by modern desktop environments such as GNOME (the default in Debian 13), KDE Plasma, and others.

Xorg is considered outdated from a security perspective due to its architecture, which lacks proper client isolation.

It is recommended to verify that your desktop environment is actually running on Wayland rather than Xorg (for example, by checking the XDG_SESSION_TYPE environment variable).

If the GNOME interface feels unfamiliar, it can be extensively customized using extensions and system settings, allowing you to adapt window behavior and panels to your preferred workflow.

====== Related Aspects of Internet Security ======

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

1. Store passwords in a reliable password manager.

'''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:

* relying on human memory, with the risk of forgetting or confusing credentials;
* storing passwords on paper media, which can be damaged, lost, or stolen;
* saving passwords in web browsers in unencrypted form;
* keeping passwords in plain text files on the desktop or in other directories without encryption;
* and similar approaches.
Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.

A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.

Regularly create up-to-date backups of the ''encrypted'' password database.

Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.

Additional Practical Recommendations: <blockquote>A password manager (for example, [https://keepassxc.org/ KeePassXC]) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.

In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.

It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).</blockquote>

2. Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [https://en.wikipedia.org/wiki/Authenticator_app Authenticator app]), or a hardware security key such as a [https://en.wikipedia.org/wiki/YubiKey YubiKey].

The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:
* YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
* It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
* Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number.

For now, it is one of the most reliable hardware-based options for two-factor authentication.

3. Using VPN to improve privacy and security

* ''If you are a private user'', you can also configure a system-wide VPN (for example, ProtonVPN) so that all device traffic is routed through it — not only browser traffic or traffic from specific applications.
Enable the “killswitch” mode and disable it only when necessary, re-enabling it immediately afterwards.
It is also recommended to periodically change VPN servers, doing so at different and unpredictable intervals.

Using a VPN increases your privacy: all of your traffic will be encrypted from observers on your local network and from your internet service provider. This makes it more difficult for an attacker to apply certain social-engineering methods based on traffic analysis, and it also helps protect your privacy in the event that your provider’s infrastructure is compromised.

* ''If you own a server'' and want access to it to be available only to trusted private or legal entities, while also increasing its protection against unauthorized access, you can configure the server so that SSH and other internal services are accessible exclusively through OpenVPN [https://openvpn.net/as-docs/tutorials/tutorial--change-tls-control-channel-security.html using TLS authentication (tls-auth / tls-crypt)] and unique client certificates instead of passwords.

4. Actively study and apply artificial intelligence to improve security configurations in Debian and other Linux distributions, as well as to address related cybersecurity tasks. A lack of knowledge often becomes the weakest link; AI can provide accurate, structured recommendations interactively and help automate repetitive or complex operations.

<blockquote>'''Note:''' Always verify AI-generated recommendations before applying them in production environments. Test any changes in an isolated system, review generated commands or configurations, and ensure that suggestions align with your threat model and security architecture.</blockquote>

In practice, users who effectively leverage AI tools are significantly better prepared, and the adoption of such technologies makes malicious activity considerably more difficult for attackers.

5. If privacy is a priority, consider reducing reliance on the Google ecosystem and switching to more privacy-focused alternatives (for example, proton.me and similar services). Google provides very strong security, but its services collect extensive telemetry for analysis. While this data is encrypted and not accessible to attackers, it may still be undesirable for users who value strict privacy.

6. Use a Wi-Fi router that supports nftables or an equivalent modern packet-filtering framework.

It is not recommended to rely on the cheapest consumer-grade routers that lack built-in security mechanisms and fine-grained traffic filtering capabilities. A router should be treated as an integral part of the overall security architecture, not as an element that increases the attack surface.

Deploying an additional network filtering layer at the entry point of a home network significantly complicates an attacker’s ability to build an effective attack configuration and increases the overall cost of an attack. Configure strict and well-defined filtering rules on the router’s nftables firewall, including inbound connection restrictions, outbound traffic control, and network segmentation where appropriate.

Access to the router’s administrative interface must be protected with a strong, unique password. Whenever possible, management access should be restricted to trusted networks or limited to wired interfaces only.

Such a configuration provides an additional layer of protection not only for the primary workstation, but also for other devices connected to the network (for example, Android-based mobile devices), which often lack the technical capability to use host-level packet filtering mechanisms such as iptables or nftables.

7. Hardware Firewall

If you handle confidential information on your computer and are in a high-risk zone for cyberattacks, consider using an additional layer of protection such as a '''hardware firewall'''.

Important note on cost: In addition to the one-time cost of the device (starting from approximately $55), an annual paid subscription is required for threat intelligence updates. Therefore, this solution is economically justified primarily in two cases:

* You work with critically important information whose leakage is unacceptable (e.g., trade secrets, client personal data, unique developments, or if your professional activities involve sensitive data in fields such as law enforcement, military, legal practice, journalism, healthcare, and so on).
* You have well-founded suspicions that you or your organization could be the target of a directed attack.

Attackers often rely on direct interaction with your devices. The presence of a dedicated, subscription-updated hardware firewall creates a significant obstacle for them. It acts as an independent filter, analyzing all incoming and outgoing traffic before it reaches your end devices. This substantially increases the cost and complexity of an attack for the malicious actor, reducing its effectiveness.

However, this should not be viewed as a panacea. '''It is an additional, not the sole, layer of defense.''' Its presence does not negate the necessity of:

* Configuring the basic security of your router.
* Using a software firewall and antivirus on your PC.
* Timely updating your operating system and applications.
* Practicing good cyber hygiene (e.g., using a password manager, being cautious of phishing).

A hardware firewall should be seamlessly integrated into your overall security architecture, forming a '''multi-layered (defense-in-depth) protection system.''' It is precisely such a system, where breaching one barrier does not lead to the compromise of the entire network, that poses the most serious challenge for attackers.

<blockquote>'''Note:''' Artificial intelligence tools, YubiKey, and other tools not directly related to Debian/Linux are mentioned here as optional technical aids, not as an endorsement of any specific service, vendor, or product. The author does not engage in commercial promotion of any software, hardware, or services, but merely provides optional recommendations for measures that directly or indirectly enhance the security of operating system usage.</blockquote>

8. It is also important to consider the possibility of hardware-level attacks.
Although such attacks are significantly less common and typically require more resources than software-based attacks, they remain a potential threat. In certain scenarios, an adversary may exploit vulnerabilities in device firmware or conduct a combined attack targeting both software and hardware layers. Examples include remote injection of malicious code into the firmware of a motherboard, router, optical modem, or other hardware components.

If, after a thorough software-level audit, a security issue remains unresolved, it is advisable '''to perform a hardware-level assessment''' as well, including verification of device firmware integrity and configuration.

'''And most importantly — give up the illusion of complete security. We live in conditions of a severe information war, and everyone must make efforts so that malicious actors cannot freely spy on desktops and servers.'''

===== Examples of Deep Custom Security Configurations =====

Below are examples of strong, individualized configurations for '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

[https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/SecurityConfigsAndLogs| Examples of Deep Custom Security Configurations (DebianWiki)]

==== UsefulPrograms ====

Here is the list of programs useful for configuring and maintaining the security of Linux systems. The included programs are either open-source (the majority) or commercial, but with freely available limited features sufficient to address core security tasks (a smaller portion).

[https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/UsefulPrograms| Useful programs reviewed by the article author (DebianWiki)]

==== Additional articles on the author's site: ====

<blockquote>'''Note:''' The following materials are provided for '''awareness, defensive, and educational purposes only'''. They are intended to help users recognize threats and build their own security. All personal data and identifiers have been anonymized.</blockquote>

[https://blackcat568.github.io/CyberSecurityAndSocialEngineering/targeted-attack-analysis.html| Author's analysis of targeted attacks] - The author provides an analysis of complex targeted attack that was used against him, including social‑engineering and psychological components, as well as cyber attack vectors and defensive measures.

[https://blackcat568.github.io/CyberSecurityAndSocialEngineering/information-and-behavioral-hygiene-for-working-with-a-pc.html| Information and Behavioral Hygiene for Working with a PC] - This is an extensive popular-science essay dedicated to comprehensive digital hygiene. Drawing on years of personal (and often bitter) experience in working with PCs, observing user behavior, working in the security sector, as well as experience in countering scammers and manipulators online, the author formulates a system of practical principles for conscious, safe, and productive work with a PC and on the Internet.

[https://blackcat568.github.io/CyberSecurityAndSocialEngineering/psychological-suppression-by-security-forces.html| Psychological Suppression via the Disbelief Effect] — The Disbelief Effect is a subtle, systemic tactic aimed at depriving a person of support, discrediting their testimony, and thereby weakening their ability to resist. When doubt, ridicule, and neglect become the social norm surrounding a particular individual, it functions as a form of psychological weapon: isolation, humiliation, loss of control over one’s own reality. This article provides a detailed analysis of the nature of the Disbelief Effect, its mechanisms, consequences, and practical recommendations: what must never be done and what can effectively be done under such pressure.

==== External Resources ====

[https://www.debian.org/doc/manuals/securing-debian-manual/index.en.html| Securing Debian Manual 3.19 — Javier Fernández-Sanguino Peña.]
This document describes security in the Debian project and in the Debian operating system. Starting with the process of securing and hardening the default Debian GNU/Linux distribution installation, it also covers some of the common tasks to set up a secure network environment using Debian GNU/Linux, gives additional information on the security tools available and talks about how security is enforced in Debian by the security and audit team.

[https://medium.com/%40ihouelecaurcy/the-complete-nftables-guide-modern-linux-firewall-mastery-79fb86894d5c| The Complete nftables Guide: Modern Linux Firewall Mastery — Ihouele Caurcy]
The definitive guide to nftables — the modern replacement for iptables, ip6tables, arptables, and ebtables. From basic concepts to enterprise-level configurations.

[https://notes.suhaib.in/docs/tech/utilities/iptables-nftables-and-you-a-friendly-guide-to-traffic-rules/| iptables, nftables, and You A Friendly Guide to Traffic Rules]
A friendly guide to iptables and nftables in Linux: explains Netfilter architecture, tables, chains and rules, with configuration examples (SSH, IP blocking, port forwarding). Covers differences between iptables and nftables, migration, and compatibility with modern firewall tools. Useful for understanding the iptables→nftables transition and practical examples.

[https://gitlab.com/apparmor/apparmor/-/wikis/home AppArmor]
The official wiki for the AppArmor security project on Linux. Provides guidance for users and developers, instructions for creating and managing security profiles, example access policies for applications, and best practices to protect the operating system.

[https://nallino.net/stockage/security/Linux_Mint_Security.pdf| Security, Privacy and Anonymity in Linux Mint — Michel Nallino.]
A good and comprehensive work on Linux Mint security that can also be useful for other Linux distributions.

[https://www.cisa.gov/topics/cybersecurity-best-practices| CISA — Cybersecurity Best Practices]
CISA (Certified Information Systems Auditor) provides information on cybersecurity best practices to help individuals and organizations implement preventative measures and manage cyber risks.

==== Provenance ====

This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131

it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks
[[Category:Security]]
[[Category:Administration]]
[[Category:Guides]]
[[Category:Full Paper]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2026-04-03T07:56:08Z

Blackcat568: /* Main Aspects of System Hardening */

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.
* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

''Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build).''

Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

====== Main Aspects of System Hardening ======

1. Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.

2. If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to use long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>

3. Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.

4. Avoid using the superuser account or ''sudo'' without a clear necessity — and never execute arbitrary scripts with ''sudo''. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
* Always read a script fully before running it (less script.sh, cat script.sh).
* Never paste commands from untrusted or unverified sources into the terminal.
* Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
* Follow the principle of least privilege — create separate user accounts and limit access rights where possible <blockquote>'''Important:''' Improper or careless use of ''sudo'' and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.</blockquote>

5. Follow a server-style access model

Do not add regular users to the ''sudo'' group. The ''sudo'' privilege should be reserved exclusively for the superuser (root). Regular users '''should not''' have the ability to execute commands as root via ''sudo''.

Yes, this can introduce some inconvenience in system administration, but this model provides a more secure configuration and reduces the risk of accidental or intentional security breaches.<blockquote>'''Note:''' system users created by the kernel or services (e.g., ''www-data'', ''postgres,'' ''nobody'') '''do not have sudo access by default'''. Programs installed using ''sudo'' by the root user '''do not automatically grant sudo privileges to users created by those programs'''. Any virtual or service accounts remain unable to run commands with ''sudo'' unless explicitly added to the sudo-enabled group.</blockquote>

6. Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. If you have difficulty configuring AppArmor, seek help from specialists or use AI-based tools.

The use of mandatory access control mechanisms represents an important layer of system protection. Without proper configuration, even a system with a correctly configured firewall may remain vulnerable to various types of attacks.<blockquote>'''Warning:''' AppArmor, SELinux and other Mandatory Access Control (MAC) mechanisms may cause system malfunction if misconfigured. Errors in profiles or policies can result in service failures, boot issues, user session lockout, or restricted access to system resources. In some cases, system recovery may be difficult even when using recovery mode, a chroot environment, or booting from a Live/Rescue medium.
</blockquote>

It is recommended to perform testing and development of complex and/or custom policies and profiles in an isolated environment (for example, in a virtual machine). It is advisable to retain change logs and terminal output for subsequent analysis.

Configuration changes should be applied to the host system '''only after confirming correct and stable operation in the test environment.'''

Additional recommendations:

* When restricting potentially vulnerable system services and daemons, use AppArmor profiles with the minimum required permissions (principle of least privilege).
* For potentially vulnerable user applications (browsers, messengers, database managers), prioritize isolation using sandboxing solutions (e.g., Flatpak, Firejail). Use AppArmor as an additional layer or in cases where sandboxing is not available.
* This approach creates an architecture where applications are isolated from each other and from the system. In the event that a sandboxed application is compromised, its access to other applications and the system as a whole will be maximally restricted, which significantly hinders further actions by an attacker.

7. Use advanced network filtering settings: iptables or nftables, or a commercial firewall.

In addition to blocking all unnecessary incoming connections (on most home workstations, you can block all incoming traffic), be sure to also restrict outgoing connections — block all ports and ranges that are not required by the system and applications. This reduces the attack surface.

My nftables config can be viewed [https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/SecurityConfigsAndLogs#| here].

In addition to iptables/nftables, it is strongly recommended to use [https://www.tecmint.com/opensnitch-linux-application-firewall/| OpenSnitch] — '''an interactive firewall''' that shows in real time the IP, process, PID, and port for each connection. OpenSnitch allows you to flexibly block suspicious activity, which, combined with nftables, provides significantly more robust protection.

OpenSnitch operates on top of nftables/iptables. Instead of merely showing "traffic on a port," it reveals exactly which process is trying to connect to where. The project is not widely known, yet it is extremely useful, actively developed, and deserves the community's attention and support.

8. Configure kernel parameters for maximum security (sysctl hardening).
My 99-protect.conf config can be viewed [https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/SecurityConfigsAndLogs#| here].

9. Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event).
My auditd config can be viewed [https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/SecurityConfigsAndLogs#| here].

10. Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.

11 If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.

12. Follow the principle of Attack Surface Reduction (or [https://en.wikipedia.org/wiki/Occam's_razor Occam's Razor]) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
* If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
* If you are certain you will never use it, remove it completely from the system.
* This practice reduces potential attack vectors and strengthens overall system security.
* Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications.
* Always create a full system backup before making any significant configuration changes or modifications.

13. Perform regular antivirus and anti-rootkit scans of the system.

In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.

14. Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:

<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>

Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

15. Use desktop environments based on Wayland.

Wayland is a modern display server protocol that provides stronger application isolation. Unlike Xorg, where any client application can potentially intercept input (keyboard, mouse) and observe other windows, Wayland implements a model in which applications do not have direct access to each other or to global input; all input handling is mediated by the compositor.

This significantly reduces the impact of a single application compromise: even if an application is exploited, it cannot transparently monitor user activity in other programs.

Wayland is supported by modern desktop environments such as GNOME (the default in Debian 13), KDE Plasma, and others.

Xorg is considered outdated from a security perspective due to its architecture, which lacks proper client isolation.

It is recommended to verify that your desktop environment is actually running on Wayland rather than Xorg (for example, by checking the XDG_SESSION_TYPE environment variable).

If the GNOME interface feels unfamiliar, it can be extensively customized using extensions and system settings, allowing you to adapt window behavior and panels to your preferred workflow.

====== Related Aspects of Internet Security ======

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

1. Store passwords in a reliable password manager.

'''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:

* relying on human memory, with the risk of forgetting or confusing credentials;
* storing passwords on paper media, which can be damaged, lost, or stolen;
* saving passwords in web browsers in unencrypted form;
* keeping passwords in plain text files on the desktop or in other directories without encryption;
* and similar approaches.
Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.

A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.

Regularly create up-to-date backups of the ''encrypted'' password database.

Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.

Additional Practical Recommendations: <blockquote>A password manager (for example, [https://keepassxc.org/ KeePassXC]) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.

In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.

It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).</blockquote>

2. Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [https://en.wikipedia.org/wiki/Authenticator_app Authenticator app]), or a hardware security key such as a [https://en.wikipedia.org/wiki/YubiKey YubiKey].

The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:
* YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
* It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
* Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number.

For now, it is one of the most reliable hardware-based options for two-factor authentication.

3. Using VPN to improve privacy and security

* ''If you are a private user'', you can also configure a system-wide VPN (for example, ProtonVPN) so that all device traffic is routed through it — not only browser traffic or traffic from specific applications.
Enable the “killswitch” mode and disable it only when necessary, re-enabling it immediately afterwards.
It is also recommended to periodically change VPN servers, doing so at different and unpredictable intervals.

Using a VPN increases your privacy: all of your traffic will be encrypted from observers on your local network and from your internet service provider. This makes it more difficult for an attacker to apply certain social-engineering methods based on traffic analysis, and it also helps protect your privacy in the event that your provider’s infrastructure is compromised.

* ''If you own a server'' and want access to it to be available only to trusted private or legal entities, while also increasing its protection against unauthorized access, you can configure the server so that SSH and other internal services are accessible exclusively through OpenVPN [https://openvpn.net/as-docs/tutorials/tutorial--change-tls-control-channel-security.html using TLS authentication (tls-auth / tls-crypt)] and unique client certificates instead of passwords.

4. Actively study and apply artificial intelligence to improve security configurations in Debian and other Linux distributions, as well as to address related cybersecurity tasks. A lack of knowledge often becomes the weakest link; AI can provide accurate, structured recommendations interactively and help automate repetitive or complex operations.

<blockquote>'''Note:''' Always verify AI-generated recommendations before applying them in production environments. Test any changes in an isolated system, review generated commands or configurations, and ensure that suggestions align with your threat model and security architecture.</blockquote>

In practice, users who effectively leverage AI tools are significantly better prepared, and the adoption of such technologies makes malicious activity considerably more difficult for attackers.

5. If privacy is a priority, consider reducing reliance on the Google ecosystem and switching to more privacy-focused alternatives (for example, proton.me and similar services). Google provides very strong security, but its services collect extensive telemetry for analysis. While this data is encrypted and not accessible to attackers, it may still be undesirable for users who value strict privacy.

6. Use a Wi-Fi router that supports nftables or an equivalent modern packet-filtering framework.

It is not recommended to rely on the cheapest consumer-grade routers that lack built-in security mechanisms and fine-grained traffic filtering capabilities. A router should be treated as an integral part of the overall security architecture, not as an element that increases the attack surface.

Deploying an additional network filtering layer at the entry point of a home network significantly complicates an attacker’s ability to build an effective attack configuration and increases the overall cost of an attack. Configure strict and well-defined filtering rules on the router’s nftables firewall, including inbound connection restrictions, outbound traffic control, and network segmentation where appropriate.

Access to the router’s administrative interface must be protected with a strong, unique password. Whenever possible, management access should be restricted to trusted networks or limited to wired interfaces only.

Such a configuration provides an additional layer of protection not only for the primary workstation, but also for other devices connected to the network (for example, Android-based mobile devices), which often lack the technical capability to use host-level packet filtering mechanisms such as iptables or nftables.

7. Hardware Firewall

If you handle confidential information on your computer and are in a high-risk zone for cyberattacks, consider using an additional layer of protection such as a '''hardware firewall'''.

Important note on cost: In addition to the one-time cost of the device (starting from approximately $55), an annual paid subscription is required for threat intelligence updates. Therefore, this solution is economically justified primarily in two cases:

* You work with critically important information whose leakage is unacceptable (e.g., trade secrets, client personal data, unique developments, or if your professional activities involve sensitive data in fields such as law enforcement, military, legal practice, journalism, healthcare, and so on).
* You have well-founded suspicions that you or your organization could be the target of a directed attack.

Attackers often rely on direct interaction with your devices. The presence of a dedicated, subscription-updated hardware firewall creates a significant obstacle for them. It acts as an independent filter, analyzing all incoming and outgoing traffic before it reaches your end devices. This substantially increases the cost and complexity of an attack for the malicious actor, reducing its effectiveness.

However, this should not be viewed as a panacea. '''It is an additional, not the sole, layer of defense.''' Its presence does not negate the necessity of:

* Configuring the basic security of your router.
* Using a software firewall and antivirus on your PC.
* Timely updating your operating system and applications.
* Practicing good cyber hygiene (e.g., using a password manager, being cautious of phishing).

A hardware firewall should be seamlessly integrated into your overall security architecture, forming a '''multi-layered (defense-in-depth) protection system.''' It is precisely such a system, where breaching one barrier does not lead to the compromise of the entire network, that poses the most serious challenge for attackers.

<blockquote>'''Note:''' Artificial intelligence tools, YubiKey, and other tools not directly related to Debian/Linux are mentioned here as optional technical aids, not as an endorsement of any specific service, vendor, or product. The author does not engage in commercial promotion of any software, hardware, or services, but merely provides optional recommendations for measures that directly or indirectly enhance the security of operating system usage.</blockquote>

8. It is also important to consider the possibility of hardware-level attacks.
Although such attacks are significantly less common and typically require more resources than software-based attacks, they remain a potential threat. In certain scenarios, an adversary may exploit vulnerabilities in device firmware or conduct a combined attack targeting both software and hardware layers. Examples include remote injection of malicious code into the firmware of a motherboard, router, optical modem, or other hardware components.

If, after a thorough software-level audit, a security issue remains unresolved, it is advisable '''to perform a hardware-level assessment''' as well, including verification of device firmware integrity and configuration.

'''And most importantly — give up the illusion of complete security. We live in conditions of a severe information war, and everyone must make efforts so that malicious actors cannot freely spy on desktops and servers.'''

===== Examples of Deep Custom Security Configurations =====

Below are examples of strong, individualized configurations for '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

[https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/SecurityConfigsAndLogs| Examples of Deep Custom Security Configurations (DebianWiki)]

==== UsefulPrograms ====

Here is the list of programs useful for configuring and maintaining the security of Linux systems. The included programs are either open-source (the majority) or commercial, but with freely available limited features sufficient to address core security tasks (a smaller portion).

[https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/UsefulPrograms| Useful programs reviewed by the article author (DebianWiki)]

==== Additional articles on the author's site: ====

<blockquote>'''Note:''' The following materials are provided for '''awareness, defensive, and educational purposes only'''. They are intended to help users recognize threats and build their own security. All personal data and identifiers have been anonymized.</blockquote>

[https://blackcat568.github.io/CyberSecurityAndSocialEngineering/targeted-attack-analysis.html| Author's analysis of targeted attacks] - The author provides an analysis of complex targeted attack that was used against him, including social‑engineering and psychological components, as well as cyber attack vectors and defensive measures.

[https://blackcat568.github.io/CyberSecurityAndSocialEngineering/information-and-behavioral-hygiene-for-working-with-a-pc.html| Information and Behavioral Hygiene for Working with a PC] - This is an extensive popular-science essay dedicated to comprehensive digital hygiene. Drawing on years of personal (and often bitter) experience in working with PCs, observing user behavior, working in the security sector, as well as experience in countering scammers and manipulators online, the author formulates a system of practical principles for conscious, safe, and productive work with a PC and on the Internet.

[https://blackcat568.github.io/CyberSecurityAndSocialEngineering/psychological-suppression-by-security-forces.html| Psychological Suppression via the Disbelief Effect] — The Disbelief Effect is a subtle, systemic tactic aimed at depriving a person of support, discrediting their testimony, and thereby weakening their ability to resist. When doubt, ridicule, and neglect become the social norm surrounding a particular individual, it functions as a form of psychological weapon: isolation, humiliation, loss of control over one’s own reality. This article provides a detailed analysis of the nature of the Disbelief Effect, its mechanisms, consequences, and practical recommendations: what must never be done and what can effectively be done under such pressure.

==== External Resources ====

[https://www.debian.org/doc/manuals/securing-debian-manual/index.en.html| Securing Debian Manual 3.19 — Javier Fernández-Sanguino Peña.]
This document describes security in the Debian project and in the Debian operating system. Starting with the process of securing and hardening the default Debian GNU/Linux distribution installation, it also covers some of the common tasks to set up a secure network environment using Debian GNU/Linux, gives additional information on the security tools available and talks about how security is enforced in Debian by the security and audit team.

[https://medium.com/%40ihouelecaurcy/the-complete-nftables-guide-modern-linux-firewall-mastery-79fb86894d5c| The Complete nftables Guide: Modern Linux Firewall Mastery — Ihouele Caurcy]
The definitive guide to nftables — the modern replacement for iptables, ip6tables, arptables, and ebtables. From basic concepts to enterprise-level configurations.

[https://notes.suhaib.in/docs/tech/utilities/iptables-nftables-and-you-a-friendly-guide-to-traffic-rules/| iptables, nftables, and You A Friendly Guide to Traffic Rules]
A friendly guide to iptables and nftables in Linux: explains Netfilter architecture, tables, chains and rules, with configuration examples (SSH, IP blocking, port forwarding). Covers differences between iptables and nftables, migration, and compatibility with modern firewall tools. Useful for understanding the iptables→nftables transition and practical examples.

[https://gitlab.com/apparmor/apparmor/-/wikis/home AppArmor]
The official wiki for the AppArmor security project on Linux. Provides guidance for users and developers, instructions for creating and managing security profiles, example access policies for applications, and best practices to protect the operating system.

[https://nallino.net/stockage/security/Linux_Mint_Security.pdf| Security, Privacy and Anonymity in Linux Mint — Michel Nallino.]
A good and comprehensive work on Linux Mint security that can also be useful for other Linux distributions.

[https://www.cisa.gov/topics/cybersecurity-best-practices| CISA — Cybersecurity Best Practices]
CISA (Certified Information Systems Auditor) provides information on cybersecurity best practices to help individuals and organizations implement preventative measures and manage cyber risks.

==== Provenance ====

This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131

it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks
[[Category:Security]]
[[Category:Administration]]
[[Category:Guides]]
[[Category:Full Paper]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2026-04-01T18:20:20Z

Blackcat568: /* Related Aspects of Internet Security */

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.
* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

''Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build).''

Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

====== Main Aspects of System Hardening ======

1. Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.

2. If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to use long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>

3. Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.

4. Avoid using the superuser account or ''sudo'' without a clear necessity — and never execute arbitrary scripts with ''sudo''. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
* Always read a script fully before running it (less script.sh, cat script.sh).
* Never paste commands from untrusted or unverified sources into the terminal.
* Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
* Follow the principle of least privilege — create separate user accounts and limit access rights where possible <blockquote>'''Important:''' Improper or careless use of ''sudo'' and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.</blockquote>

5. Follow a server-style access model

Do not add regular users to the ''sudo'' group. The ''sudo'' privilege should be reserved exclusively for the superuser (root). Regular users '''should not''' have the ability to execute commands as root via ''sudo''.

Yes, this can introduce some inconvenience in system administration, but this model provides a more secure configuration and reduces the risk of accidental or intentional security breaches.<blockquote>'''Note:''' system users created by the kernel or services (e.g., ''www-data'', ''postgres,'' ''nobody'') '''do not have sudo access by default'''. Programs installed using ''sudo'' by the root user '''do not automatically grant sudo privileges to users created by those programs'''. Any virtual or service accounts remain unable to run commands with ''sudo'' unless explicitly added to the sudo-enabled group.</blockquote>

6. Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. If you have difficulty configuring AppArmor, seek help from specialists or use AI-based tools.

The use of mandatory access control mechanisms represents an important layer of system protection. Without proper configuration, even a system with a correctly configured firewall may remain vulnerable to various types of attacks.<blockquote>'''Warning:''' AppArmor, SELinux and other Mandatory Access Control (MAC) mechanisms may cause system malfunction if misconfigured. Errors in profiles or policies can result in service failures, boot issues, user session lockout, or restricted access to system resources. In some cases, system recovery may be difficult even when using recovery mode, a chroot environment, or booting from a Live/Rescue medium.
</blockquote>

It is recommended to perform testing and development of complex and/or custom policies and profiles in an isolated environment (for example, in a virtual machine). It is advisable to retain change logs and terminal output for subsequent analysis.

Configuration changes should be applied to the host system '''only after confirming correct and stable operation in the test environment.'''

Additional recommendations:

* When restricting potentially vulnerable system services and daemons, use AppArmor profiles with the minimum required permissions (principle of least privilege).
* For potentially vulnerable user applications (browsers, messengers, database managers), prioritize isolation using sandboxing solutions (e.g., Flatpak, Firejail). Use AppArmor as an additional layer or in cases where sandboxing is not available.
* This approach creates an architecture where applications are isolated from each other and from the system. In the event that a sandboxed application is compromised, its access to other applications and the system as a whole will be maximally restricted, which significantly hinders further actions by an attacker.

7. Use advanced network filtering settings: iptables or nftables, or a commercial firewall.

In addition to blocking all unnecessary incoming connections (on most home workstations, you can block all incoming traffic), be sure to also restrict outgoing connections — block all ports and ranges that are not required by the system and applications. This reduces the attack surface.

My nftables config can be viewed [https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/SecurityConfigsAndLogs#| here].

In addition to iptables/nftables, it is strongly recommended to use [https://www.tecmint.com/opensnitch-linux-application-firewall/| OpenSnitch] — '''an interactive firewall''' that shows in real time the IP, process, PID, and port for each connection. OpenSnitch allows you to flexibly block suspicious activity, which, combined with nftables, provides significantly more robust protection.

8. Configure kernel parameters for maximum security (sysctl hardening).
My 99-protect.conf config can be viewed [https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/SecurityConfigsAndLogs#| here].

9. Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event).
My auditd config can be viewed [https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/SecurityConfigsAndLogs#| here].

10. Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.

11 If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.

12. Follow the principle of Attack Surface Reduction (or [https://en.wikipedia.org/wiki/Occam's_razor Occam's Razor]) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
* If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
* If you are certain you will never use it, remove it completely from the system.
* This practice reduces potential attack vectors and strengthens overall system security.
* Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications.
* Always create a full system backup before making any significant configuration changes or modifications.

13. Perform regular antivirus and anti-rootkit scans of the system.

In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.

14. Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:

<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>

Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

15. Use desktop environments based on Wayland.

Wayland is a modern display server protocol that provides stronger application isolation. Unlike Xorg, where any client application can potentially intercept input (keyboard, mouse) and observe other windows, Wayland implements a model in which applications do not have direct access to each other or to global input; all input handling is mediated by the compositor.

This significantly reduces the impact of a single application compromise: even if an application is exploited, it cannot transparently monitor user activity in other programs.

Wayland is supported by modern desktop environments such as GNOME (the default in Debian 13), KDE Plasma, and others.

Xorg is considered outdated from a security perspective due to its architecture, which lacks proper client isolation.

It is recommended to verify that your desktop environment is actually running on Wayland rather than Xorg (for example, by checking the XDG_SESSION_TYPE environment variable).

If the GNOME interface feels unfamiliar, it can be extensively customized using extensions and system settings, allowing you to adapt window behavior and panels to your preferred workflow.

====== Related Aspects of Internet Security ======

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

1. Store passwords in a reliable password manager.

'''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:

* relying on human memory, with the risk of forgetting or confusing credentials;
* storing passwords on paper media, which can be damaged, lost, or stolen;
* saving passwords in web browsers in unencrypted form;
* keeping passwords in plain text files on the desktop or in other directories without encryption;
* and similar approaches.
Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.

A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.

Regularly create up-to-date backups of the ''encrypted'' password database.

Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.

Additional Practical Recommendations: <blockquote>A password manager (for example, [https://keepassxc.org/ KeePassXC]) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.

In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.

It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).</blockquote>

2. Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [https://en.wikipedia.org/wiki/Authenticator_app Authenticator app]), or a hardware security key such as a [https://en.wikipedia.org/wiki/YubiKey YubiKey].

The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:
* YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
* It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
* Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number.

For now, it is one of the most reliable hardware-based options for two-factor authentication.

3. Using VPN to improve privacy and security

* ''If you are a private user'', you can also configure a system-wide VPN (for example, ProtonVPN) so that all device traffic is routed through it — not only browser traffic or traffic from specific applications.
Enable the “killswitch” mode and disable it only when necessary, re-enabling it immediately afterwards.
It is also recommended to periodically change VPN servers, doing so at different and unpredictable intervals.

Using a VPN increases your privacy: all of your traffic will be encrypted from observers on your local network and from your internet service provider. This makes it more difficult for an attacker to apply certain social-engineering methods based on traffic analysis, and it also helps protect your privacy in the event that your provider’s infrastructure is compromised.

* ''If you own a server'' and want access to it to be available only to trusted private or legal entities, while also increasing its protection against unauthorized access, you can configure the server so that SSH and other internal services are accessible exclusively through OpenVPN [https://openvpn.net/as-docs/tutorials/tutorial--change-tls-control-channel-security.html using TLS authentication (tls-auth / tls-crypt)] and unique client certificates instead of passwords.

4. Actively study and apply artificial intelligence to improve security configurations in Debian and other Linux distributions, as well as to address related cybersecurity tasks. A lack of knowledge often becomes the weakest link; AI can provide accurate, structured recommendations interactively and help automate repetitive or complex operations.

<blockquote>'''Note:''' Always verify AI-generated recommendations before applying them in production environments. Test any changes in an isolated system, review generated commands or configurations, and ensure that suggestions align with your threat model and security architecture.</blockquote>

In practice, users who effectively leverage AI tools are significantly better prepared, and the adoption of such technologies makes malicious activity considerably more difficult for attackers.

5. If privacy is a priority, consider reducing reliance on the Google ecosystem and switching to more privacy-focused alternatives (for example, proton.me and similar services). Google provides very strong security, but its services collect extensive telemetry for analysis. While this data is encrypted and not accessible to attackers, it may still be undesirable for users who value strict privacy.

6. Use a Wi-Fi router that supports nftables or an equivalent modern packet-filtering framework.

It is not recommended to rely on the cheapest consumer-grade routers that lack built-in security mechanisms and fine-grained traffic filtering capabilities. A router should be treated as an integral part of the overall security architecture, not as an element that increases the attack surface.

Deploying an additional network filtering layer at the entry point of a home network significantly complicates an attacker’s ability to build an effective attack configuration and increases the overall cost of an attack. Configure strict and well-defined filtering rules on the router’s nftables firewall, including inbound connection restrictions, outbound traffic control, and network segmentation where appropriate.

Access to the router’s administrative interface must be protected with a strong, unique password. Whenever possible, management access should be restricted to trusted networks or limited to wired interfaces only.

Such a configuration provides an additional layer of protection not only for the primary workstation, but also for other devices connected to the network (for example, Android-based mobile devices), which often lack the technical capability to use host-level packet filtering mechanisms such as iptables or nftables.

7. Hardware Firewall

If you handle confidential information on your computer and are in a high-risk zone for cyberattacks, consider using an additional layer of protection such as a '''hardware firewall'''.

Important note on cost: In addition to the one-time cost of the device (starting from approximately $55), an annual paid subscription is required for threat intelligence updates. Therefore, this solution is economically justified primarily in two cases:

* You work with critically important information whose leakage is unacceptable (e.g., trade secrets, client personal data, unique developments, or if your professional activities involve sensitive data in fields such as law enforcement, military, legal practice, journalism, healthcare, and so on).
* You have well-founded suspicions that you or your organization could be the target of a directed attack.

Attackers often rely on direct interaction with your devices. The presence of a dedicated, subscription-updated hardware firewall creates a significant obstacle for them. It acts as an independent filter, analyzing all incoming and outgoing traffic before it reaches your end devices. This substantially increases the cost and complexity of an attack for the malicious actor, reducing its effectiveness.

However, this should not be viewed as a panacea. '''It is an additional, not the sole, layer of defense.''' Its presence does not negate the necessity of:

* Configuring the basic security of your router.
* Using a software firewall and antivirus on your PC.
* Timely updating your operating system and applications.
* Practicing good cyber hygiene (e.g., using a password manager, being cautious of phishing).

A hardware firewall should be seamlessly integrated into your overall security architecture, forming a '''multi-layered (defense-in-depth) protection system.''' It is precisely such a system, where breaching one barrier does not lead to the compromise of the entire network, that poses the most serious challenge for attackers.

<blockquote>'''Note:''' Artificial intelligence tools, YubiKey, and other tools not directly related to Debian/Linux are mentioned here as optional technical aids, not as an endorsement of any specific service, vendor, or product. The author does not engage in commercial promotion of any software, hardware, or services, but merely provides optional recommendations for measures that directly or indirectly enhance the security of operating system usage.</blockquote>

8. It is also important to consider the possibility of hardware-level attacks.
Although such attacks are significantly less common and typically require more resources than software-based attacks, they remain a potential threat. In certain scenarios, an adversary may exploit vulnerabilities in device firmware or conduct a combined attack targeting both software and hardware layers. Examples include remote injection of malicious code into the firmware of a motherboard, router, optical modem, or other hardware components.

If, after a thorough software-level audit, a security issue remains unresolved, it is advisable '''to perform a hardware-level assessment''' as well, including verification of device firmware integrity and configuration.

'''And most importantly — give up the illusion of complete security. We live in conditions of a severe information war, and everyone must make efforts so that malicious actors cannot freely spy on desktops and servers.'''

===== Examples of Deep Custom Security Configurations =====

Below are examples of strong, individualized configurations for '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

[https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/SecurityConfigsAndLogs| Examples of Deep Custom Security Configurations (DebianWiki)]

==== UsefulPrograms ====

Here is the list of programs useful for configuring and maintaining the security of Linux systems. The included programs are either open-source (the majority) or commercial, but with freely available limited features sufficient to address core security tasks (a smaller portion).

[https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/UsefulPrograms| Useful programs reviewed by the article author (DebianWiki)]

==== Additional articles on the author's site: ====

<blockquote>'''Note:''' The following materials are provided for '''awareness, defensive, and educational purposes only'''. They are intended to help users recognize threats and build their own security. All personal data and identifiers have been anonymized.</blockquote>

[https://blackcat568.github.io/CyberSecurityAndSocialEngineering/targeted-attack-analysis.html| Author's analysis of targeted attacks] - The author provides an analysis of complex targeted attack that was used against him, including social‑engineering and psychological components, as well as cyber attack vectors and defensive measures.

[https://blackcat568.github.io/CyberSecurityAndSocialEngineering/information-and-behavioral-hygiene-for-working-with-a-pc.html| Information and Behavioral Hygiene for Working with a PC] - This is an extensive popular-science essay dedicated to comprehensive digital hygiene. Drawing on years of personal (and often bitter) experience in working with PCs, observing user behavior, working in the security sector, as well as experience in countering scammers and manipulators online, the author formulates a system of practical principles for conscious, safe, and productive work with a PC and on the Internet.

[https://blackcat568.github.io/CyberSecurityAndSocialEngineering/psychological-suppression-by-security-forces.html| Psychological Suppression via the Disbelief Effect] — The Disbelief Effect is a subtle, systemic tactic aimed at depriving a person of support, discrediting their testimony, and thereby weakening their ability to resist. When doubt, ridicule, and neglect become the social norm surrounding a particular individual, it functions as a form of psychological weapon: isolation, humiliation, loss of control over one’s own reality. This article provides a detailed analysis of the nature of the Disbelief Effect, its mechanisms, consequences, and practical recommendations: what must never be done and what can effectively be done under such pressure.

==== External Resources ====

[https://www.debian.org/doc/manuals/securing-debian-manual/index.en.html| Securing Debian Manual 3.19 — Javier Fernández-Sanguino Peña.]
This document describes security in the Debian project and in the Debian operating system. Starting with the process of securing and hardening the default Debian GNU/Linux distribution installation, it also covers some of the common tasks to set up a secure network environment using Debian GNU/Linux, gives additional information on the security tools available and talks about how security is enforced in Debian by the security and audit team.

[https://medium.com/%40ihouelecaurcy/the-complete-nftables-guide-modern-linux-firewall-mastery-79fb86894d5c| The Complete nftables Guide: Modern Linux Firewall Mastery — Ihouele Caurcy]
The definitive guide to nftables — the modern replacement for iptables, ip6tables, arptables, and ebtables. From basic concepts to enterprise-level configurations.

[https://notes.suhaib.in/docs/tech/utilities/iptables-nftables-and-you-a-friendly-guide-to-traffic-rules/| iptables, nftables, and You A Friendly Guide to Traffic Rules]
A friendly guide to iptables and nftables in Linux: explains Netfilter architecture, tables, chains and rules, with configuration examples (SSH, IP blocking, port forwarding). Covers differences between iptables and nftables, migration, and compatibility with modern firewall tools. Useful for understanding the iptables→nftables transition and practical examples.

[https://gitlab.com/apparmor/apparmor/-/wikis/home AppArmor]
The official wiki for the AppArmor security project on Linux. Provides guidance for users and developers, instructions for creating and managing security profiles, example access policies for applications, and best practices to protect the operating system.

[https://nallino.net/stockage/security/Linux_Mint_Security.pdf| Security, Privacy and Anonymity in Linux Mint — Michel Nallino.]
A good and comprehensive work on Linux Mint security that can also be useful for other Linux distributions.

[https://www.cisa.gov/topics/cybersecurity-best-practices| CISA — Cybersecurity Best Practices]
CISA (Certified Information Systems Auditor) provides information on cybersecurity best practices to help individuals and organizations implement preventative measures and manage cyber risks.

==== Provenance ====

This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131

it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks
[[Category:Security]]
[[Category:Administration]]
[[Category:Guides]]
[[Category:Full Paper]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2026-04-01T18:19:13Z

Blackcat568: /* Main Aspects of System Hardening */

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.
* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

''Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build).''

Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

====== Main Aspects of System Hardening ======

1. Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.

2. If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to use long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>

3. Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.

4. Avoid using the superuser account or ''sudo'' without a clear necessity — and never execute arbitrary scripts with ''sudo''. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
* Always read a script fully before running it (less script.sh, cat script.sh).
* Never paste commands from untrusted or unverified sources into the terminal.
* Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
* Follow the principle of least privilege — create separate user accounts and limit access rights where possible <blockquote>'''Important:''' Improper or careless use of ''sudo'' and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.</blockquote>

5. Follow a server-style access model

Do not add regular users to the ''sudo'' group. The ''sudo'' privilege should be reserved exclusively for the superuser (root). Regular users '''should not''' have the ability to execute commands as root via ''sudo''.

Yes, this can introduce some inconvenience in system administration, but this model provides a more secure configuration and reduces the risk of accidental or intentional security breaches.<blockquote>'''Note:''' system users created by the kernel or services (e.g., ''www-data'', ''postgres,'' ''nobody'') '''do not have sudo access by default'''. Programs installed using ''sudo'' by the root user '''do not automatically grant sudo privileges to users created by those programs'''. Any virtual or service accounts remain unable to run commands with ''sudo'' unless explicitly added to the sudo-enabled group.</blockquote>

6. Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. If you have difficulty configuring AppArmor, seek help from specialists or use AI-based tools.

The use of mandatory access control mechanisms represents an important layer of system protection. Without proper configuration, even a system with a correctly configured firewall may remain vulnerable to various types of attacks.<blockquote>'''Warning:''' AppArmor, SELinux and other Mandatory Access Control (MAC) mechanisms may cause system malfunction if misconfigured. Errors in profiles or policies can result in service failures, boot issues, user session lockout, or restricted access to system resources. In some cases, system recovery may be difficult even when using recovery mode, a chroot environment, or booting from a Live/Rescue medium.
</blockquote>

It is recommended to perform testing and development of complex and/or custom policies and profiles in an isolated environment (for example, in a virtual machine). It is advisable to retain change logs and terminal output for subsequent analysis.

Configuration changes should be applied to the host system '''only after confirming correct and stable operation in the test environment.'''

Additional recommendations:

* When restricting potentially vulnerable system services and daemons, use AppArmor profiles with the minimum required permissions (principle of least privilege).
* For potentially vulnerable user applications (browsers, messengers, database managers), prioritize isolation using sandboxing solutions (e.g., Flatpak, Firejail). Use AppArmor as an additional layer or in cases where sandboxing is not available.
* This approach creates an architecture where applications are isolated from each other and from the system. In the event that a sandboxed application is compromised, its access to other applications and the system as a whole will be maximally restricted, which significantly hinders further actions by an attacker.

7. Use advanced network filtering settings: iptables or nftables, or a commercial firewall.

In addition to blocking all unnecessary incoming connections (on most home workstations, you can block all incoming traffic), be sure to also restrict outgoing connections — block all ports and ranges that are not required by the system and applications. This reduces the attack surface.

My nftables config can be viewed [https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/SecurityConfigsAndLogs#| here].

In addition to iptables/nftables, it is strongly recommended to use [https://www.tecmint.com/opensnitch-linux-application-firewall/| OpenSnitch] — '''an interactive firewall''' that shows in real time the IP, process, PID, and port for each connection. OpenSnitch allows you to flexibly block suspicious activity, which, combined with nftables, provides significantly more robust protection.

8. Configure kernel parameters for maximum security (sysctl hardening).
My 99-protect.conf config can be viewed [https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/SecurityConfigsAndLogs#| here].

9. Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event).
My auditd config can be viewed [https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/SecurityConfigsAndLogs#| here].

10. Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.

11 If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.

12. Follow the principle of Attack Surface Reduction (or [https://en.wikipedia.org/wiki/Occam's_razor Occam's Razor]) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
* If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
* If you are certain you will never use it, remove it completely from the system.
* This practice reduces potential attack vectors and strengthens overall system security.
* Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications.
* Always create a full system backup before making any significant configuration changes or modifications.

13. Perform regular antivirus and anti-rootkit scans of the system.

In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.

14. Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:

<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>

Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

15. Use desktop environments based on Wayland.

Wayland is a modern display server protocol that provides stronger application isolation. Unlike Xorg, where any client application can potentially intercept input (keyboard, mouse) and observe other windows, Wayland implements a model in which applications do not have direct access to each other or to global input; all input handling is mediated by the compositor.

This significantly reduces the impact of a single application compromise: even if an application is exploited, it cannot transparently monitor user activity in other programs.

Wayland is supported by modern desktop environments such as GNOME (the default in Debian 13), KDE Plasma, and others.

Xorg is considered outdated from a security perspective due to its architecture, which lacks proper client isolation.

It is recommended to verify that your desktop environment is actually running on Wayland rather than Xorg (for example, by checking the XDG_SESSION_TYPE environment variable).

If the GNOME interface feels unfamiliar, it can be extensively customized using extensions and system settings, allowing you to adapt window behavior and panels to your preferred workflow.

====== Related Aspects of Internet Security ======

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

1. Store passwords in a reliable password manager. '''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:

* relying on human memory, with the risk of forgetting or confusing credentials;
* storing passwords on paper media, which can be damaged, lost, or stolen;
* saving passwords in web browsers in unencrypted form;
* keeping passwords in plain text files on the desktop or in other directories without encryption;
* and similar approaches.
Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.

A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.

Regularly create up-to-date backups of the ''encrypted'' password database.

Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.

Additional Practical Recommendations: <blockquote>A password manager (for example, [https://keepassxc.org/ KeePassXC]) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.

In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.

It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).</blockquote>

2. Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [https://en.wikipedia.org/wiki/Authenticator_app Authenticator app]), or a hardware security key such as a [https://en.wikipedia.org/wiki/YubiKey YubiKey].

The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:
* YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
* It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
* Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number.

For now, it is one of the most reliable hardware-based options for two-factor authentication.

3. Using VPN to improve privacy and security

* ''If you are a private user'', you can also configure a system-wide VPN (for example, ProtonVPN) so that all device traffic is routed through it — not only browser traffic or traffic from specific applications.
Enable the “killswitch” mode and disable it only when necessary, re-enabling it immediately afterwards.
It is also recommended to periodically change VPN servers, doing so at different and unpredictable intervals.

Using a VPN increases your privacy: all of your traffic will be encrypted from observers on your local network and from your internet service provider. This makes it more difficult for an attacker to apply certain social-engineering methods based on traffic analysis, and it also helps protect your privacy in the event that your provider’s infrastructure is compromised.

* ''If you own a server'' and want access to it to be available only to trusted private or legal entities, while also increasing its protection against unauthorized access, you can configure the server so that SSH and other internal services are accessible exclusively through OpenVPN [https://openvpn.net/as-docs/tutorials/tutorial--change-tls-control-channel-security.html using TLS authentication (tls-auth / tls-crypt)] and unique client certificates instead of passwords.

4. Actively study and apply artificial intelligence to improve security configurations in Debian and other Linux distributions, as well as to address related cybersecurity tasks. A lack of knowledge often becomes the weakest link; AI can provide accurate, structured recommendations interactively and help automate repetitive or complex operations.

<blockquote>'''Note:''' Always verify AI-generated recommendations before applying them in production environments. Test any changes in an isolated system, review generated commands or configurations, and ensure that suggestions align with your threat model and security architecture.</blockquote>

In practice, users who effectively leverage AI tools are significantly better prepared, and the adoption of such technologies makes malicious activity considerably more difficult for attackers.

5. If privacy is a priority, consider reducing reliance on the Google ecosystem and switching to more privacy-focused alternatives (for example, proton.me and similar services). Google provides very strong security, but its services collect extensive telemetry for analysis. While this data is encrypted and not accessible to attackers, it may still be undesirable for users who value strict privacy.

6. Use a Wi-Fi router that supports nftables or an equivalent modern packet-filtering framework.

It is not recommended to rely on the cheapest consumer-grade routers that lack built-in security mechanisms and fine-grained traffic filtering capabilities. A router should be treated as an integral part of the overall security architecture, not as an element that increases the attack surface.

Deploying an additional network filtering layer at the entry point of a home network significantly complicates an attacker’s ability to build an effective attack configuration and increases the overall cost of an attack. Configure strict and well-defined filtering rules on the router’s nftables firewall, including inbound connection restrictions, outbound traffic control, and network segmentation where appropriate.

Access to the router’s administrative interface must be protected with a strong, unique password. Whenever possible, management access should be restricted to trusted networks or limited to wired interfaces only.

Such a configuration provides an additional layer of protection not only for the primary workstation, but also for other devices connected to the network (for example, Android-based mobile devices), which often lack the technical capability to use host-level packet filtering mechanisms such as iptables or nftables.

7. Hardware Firewall

If you handle confidential information on your computer and are in a high-risk zone for cyberattacks, consider using an additional layer of protection such as a '''hardware firewall'''.

Important note on cost: In addition to the one-time cost of the device (starting from approximately $55), an annual paid subscription is required for threat intelligence updates. Therefore, this solution is economically justified primarily in two cases:

* You work with critically important information whose leakage is unacceptable (e.g., trade secrets, client personal data, unique developments, or if your professional activities involve sensitive data in fields such as law enforcement, military, legal practice, journalism, healthcare, and so on).
* You have well-founded suspicions that you or your organization could be the target of a directed attack.

Attackers often rely on direct interaction with your devices. The presence of a dedicated, subscription-updated hardware firewall creates a significant obstacle for them. It acts as an independent filter, analyzing all incoming and outgoing traffic before it reaches your end devices. This substantially increases the cost and complexity of an attack for the malicious actor, reducing its effectiveness.

However, this should not be viewed as a panacea. '''It is an additional, not the sole, layer of defense.''' Its presence does not negate the necessity of:

* Configuring the basic security of your router.
* Using a software firewall and antivirus on your PC.
* Timely updating your operating system and applications.
* Practicing good cyber hygiene (e.g., using a password manager, being cautious of phishing).

A hardware firewall should be seamlessly integrated into your overall security architecture, forming a '''multi-layered (defense-in-depth) protection system.''' It is precisely such a system, where breaching one barrier does not lead to the compromise of the entire network, that poses the most serious challenge for attackers.

<blockquote>'''Note:''' Artificial intelligence tools, YubiKey, and other tools not directly related to Debian/Linux are mentioned here as optional technical aids, not as an endorsement of any specific service, vendor, or product. The author does not engage in commercial promotion of any software, hardware, or services, but merely provides optional recommendations for measures that directly or indirectly enhance the security of operating system usage.</blockquote>

8. It is also important to consider the possibility of hardware-level attacks.
Although such attacks are significantly less common and typically require more resources than software-based attacks, they remain a potential threat. In certain scenarios, an adversary may exploit vulnerabilities in device firmware or conduct a combined attack targeting both software and hardware layers. Examples include remote injection of malicious code into the firmware of a motherboard, router, optical modem, or other hardware components.

If, after a thorough software-level audit, a security issue remains unresolved, it is advisable '''to perform a hardware-level assessment''' as well, including verification of device firmware integrity and configuration.

'''And most importantly — give up the illusion of complete security. We live in conditions of a severe information war, and everyone must make efforts so that malicious actors cannot freely spy on desktops and servers.'''

===== Examples of Deep Custom Security Configurations =====

Below are examples of strong, individualized configurations for '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

[https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/SecurityConfigsAndLogs| Examples of Deep Custom Security Configurations (DebianWiki)]

==== UsefulPrograms ====

Here is the list of programs useful for configuring and maintaining the security of Linux systems. The included programs are either open-source (the majority) or commercial, but with freely available limited features sufficient to address core security tasks (a smaller portion).

[https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/UsefulPrograms| Useful programs reviewed by the article author (DebianWiki)]

==== Additional articles on the author's site: ====

<blockquote>'''Note:''' The following materials are provided for '''awareness, defensive, and educational purposes only'''. They are intended to help users recognize threats and build their own security. All personal data and identifiers have been anonymized.</blockquote>

[https://blackcat568.github.io/CyberSecurityAndSocialEngineering/targeted-attack-analysis.html| Author's analysis of targeted attacks] - The author provides an analysis of complex targeted attack that was used against him, including social‑engineering and psychological components, as well as cyber attack vectors and defensive measures.

[https://blackcat568.github.io/CyberSecurityAndSocialEngineering/information-and-behavioral-hygiene-for-working-with-a-pc.html| Information and Behavioral Hygiene for Working with a PC] - This is an extensive popular-science essay dedicated to comprehensive digital hygiene. Drawing on years of personal (and often bitter) experience in working with PCs, observing user behavior, working in the security sector, as well as experience in countering scammers and manipulators online, the author formulates a system of practical principles for conscious, safe, and productive work with a PC and on the Internet.

[https://blackcat568.github.io/CyberSecurityAndSocialEngineering/psychological-suppression-by-security-forces.html| Psychological Suppression via the Disbelief Effect] — The Disbelief Effect is a subtle, systemic tactic aimed at depriving a person of support, discrediting their testimony, and thereby weakening their ability to resist. When doubt, ridicule, and neglect become the social norm surrounding a particular individual, it functions as a form of psychological weapon: isolation, humiliation, loss of control over one’s own reality. This article provides a detailed analysis of the nature of the Disbelief Effect, its mechanisms, consequences, and practical recommendations: what must never be done and what can effectively be done under such pressure.

==== External Resources ====

[https://www.debian.org/doc/manuals/securing-debian-manual/index.en.html| Securing Debian Manual 3.19 — Javier Fernández-Sanguino Peña.]
This document describes security in the Debian project and in the Debian operating system. Starting with the process of securing and hardening the default Debian GNU/Linux distribution installation, it also covers some of the common tasks to set up a secure network environment using Debian GNU/Linux, gives additional information on the security tools available and talks about how security is enforced in Debian by the security and audit team.

[https://medium.com/%40ihouelecaurcy/the-complete-nftables-guide-modern-linux-firewall-mastery-79fb86894d5c| The Complete nftables Guide: Modern Linux Firewall Mastery — Ihouele Caurcy]
The definitive guide to nftables — the modern replacement for iptables, ip6tables, arptables, and ebtables. From basic concepts to enterprise-level configurations.

[https://notes.suhaib.in/docs/tech/utilities/iptables-nftables-and-you-a-friendly-guide-to-traffic-rules/| iptables, nftables, and You A Friendly Guide to Traffic Rules]
A friendly guide to iptables and nftables in Linux: explains Netfilter architecture, tables, chains and rules, with configuration examples (SSH, IP blocking, port forwarding). Covers differences between iptables and nftables, migration, and compatibility with modern firewall tools. Useful for understanding the iptables→nftables transition and practical examples.

[https://gitlab.com/apparmor/apparmor/-/wikis/home AppArmor]
The official wiki for the AppArmor security project on Linux. Provides guidance for users and developers, instructions for creating and managing security profiles, example access policies for applications, and best practices to protect the operating system.

[https://nallino.net/stockage/security/Linux_Mint_Security.pdf| Security, Privacy and Anonymity in Linux Mint — Michel Nallino.]
A good and comprehensive work on Linux Mint security that can also be useful for other Linux distributions.

[https://www.cisa.gov/topics/cybersecurity-best-practices| CISA — Cybersecurity Best Practices]
CISA (Certified Information Systems Auditor) provides information on cybersecurity best practices to help individuals and organizations implement preventative measures and manage cyber risks.

==== Provenance ====

This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131

it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks
[[Category:Security]]
[[Category:Administration]]
[[Category:Guides]]
[[Category:Full Paper]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2026-02-19T20:32:40Z

Blackcat568: /* Main Aspects of System Hardening */

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2026-02-16T14:30:51Z

Blackcat568: /* Additional articles on the author's site: */

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2026-02-16T14:28:35Z

Blackcat568: /* External Resources */

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2026-02-16T14:27:49Z

Blackcat568: /* Examples of Deep Custom Security Configurations */

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2026-02-16T14:24:54Z

Blackcat568: /* Main Aspects of System Hardening */

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2026-01-29T01:47:06Z

Blackcat568: /* Security Hardening for Debian Users: Protecting Against Targeted Attacks */

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2026-01-29T01:43:37Z

Blackcat568: /* Related Aspects of Internet Security */

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2026-01-29T01:40:20Z

Blackcat568: /* Related Aspects of Internet Security */

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2026-01-29T01:38:53Z

Blackcat568: /* Related Aspects of Internet Security */

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2026-01-28T13:40:15Z

Blackcat568: /* Additional articles on the author's site: */

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2026-01-28T13:27:37Z

Blackcat568: /* Additional articles on the author's site: */

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2026-01-28T13:24:29Z

Blackcat568:

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2026-01-14T18:11:20Z

Blackcat568: /* Main Aspects of System Hardening */

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2026-01-14T17:50:37Z

Blackcat568: /* Main Aspects of System Hardening */

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2026-01-14T01:37:55Z

Blackcat568: /* Main Aspects of System Hardening */

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2026-01-14T01:34:27Z

Blackcat568: /* Main Aspects of System Hardening */

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2026-01-04T18:27:37Z

Blackcat568: /* External Resources */

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2026-01-04T18:24:37Z

Blackcat568: /* UsefulPrograms */

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2026-01-04T18:14:21Z

Blackcat568: /* Examples of Deep Custom Security Configurations */

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2025-12-28T23:01:37Z

Blackcat568: added paragraph about using routers with nftables function

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.
* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

''Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build).''

Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

====== Main Aspects of System Hardening ======

1. Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.

2. If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to type long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>

3. Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.

4. Avoid using the superuser account or sudo without a clear necessity — and never execute arbitrary scripts with sudo. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
* Always read a script fully before running it (less script.sh, cat script.sh).
* Never paste commands from untrusted or unverified sources into the terminal.
* Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
* Follow the principle of least privilege — create separate user accounts and limit access rights where possible <blockquote>'''Important:''' Improper or careless use of sudo and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.</blockquote>

5. Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. You may also consider switching to SELinux. If you have difficulty configuring AppArmor or SELinux, seek help from specialists or use AI-based tools. My SELinux configuration is attached below (I use SELinux on Debian 12 — it works reliably).

6. Use advanced network filtering settings: iptables or nftables, or a commercial firewall. (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#nftables config:|nftables config]]

7. Configure kernel parameters for maximum security (sysctl hardening). (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#sysctl config:|sysctl config]])

8. Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event). (sample [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#auditd rules config:|auditd rules config]]

9. Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.

10 If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.

11. Follow the principle of Attack Surface Reduction (or [https://en.wikipedia.org/wiki/Occam's_razor Occam's Razor]) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
* If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
* If you are certain you will never use it, remove it completely from the system.
* This practice reduces potential attack vectors and strengthens overall system security.
* Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications.
* Always create a full system backup before making any significant configuration changes or modifications.

12. Perform regular antivirus and anti-rootkit scans of the system. In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.

13. Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:

<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>

Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

====== Related Aspects of Internet Security ======

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

1. Store passwords in a reliable password manager. '''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:

* relying on human memory, with the risk of forgetting or confusing credentials;
* storing passwords on paper media, which can be damaged, lost, or stolen;
* saving passwords in web browsers in unencrypted form;
* keeping passwords in plain text files on the desktop or in other directories without encryption;
* and similar approaches.
Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.

A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.

Regularly create up-to-date backups of the ''encrypted'' password database.

Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.

Additional Practical Recommendations: <blockquote>A password manager (for example, [https://keepassxc.org/ KeePassXC]) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.

In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.

It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).</blockquote>

2. Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [https://en.wikipedia.org/wiki/Authenticator_app Authenticator app]), or a hardware security key such as a [https://en.wikipedia.org/wiki/YubiKey YubiKey].

The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:
* YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
* It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
* Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number.

For now, it is one of the most reliable hardware-based options for two-factor authentication.

3. Using VPN to improve privacy and security

* ''If you are a private user'', you can also configure a system-wide VPN (for example, ProtonVPN) so that all device traffic is routed through it — not only browser traffic or traffic from specific applications.
Enable the “killswitch” mode and disable it only when necessary, re-enabling it immediately afterwards.
It is also recommended to periodically change VPN servers, doing so at different and unpredictable intervals.

Using a VPN increases your privacy: all of your traffic will be encrypted from observers on your local network and from your internet service provider. This makes it more difficult for an attacker to apply certain social-engineering methods based on traffic analysis, and it also helps protect your privacy in the event that your provider’s infrastructure is compromised.

* ''If you own a server'' and want access to it to be available only to trusted private or legal entities, while also increasing its protection against unauthorized access, you can configure the server so that SSH and other internal services are accessible exclusively through OpenVPN [https://openvpn.net/as-docs/tutorials/tutorial--change-tls-control-channel-security.html using TLS authentication (tls-auth / tls-crypt)] and unique client certificates instead of passwords.

4. Actively study and apply artificial intelligence to improve security configurations in Debian and other Linux distributions, as well as to address related cybersecurity tasks. A lack of knowledge often becomes the weakest link; AI can provide accurate, structured recommendations interactively and help automate repetitive or complex operations.

{{{#!wiki note
Always verify AI-generated recommendations before applying them in production environments. Test any changes in an isolated system, review generated commands or configurations, and ensure that suggestions align with your threat model and security architecture.
In practice, users who effectively leverage AI tools are significantly better prepared, and the adoption of such technologies makes malicious activity considerably more difficult for attackers.
}}}

5. If privacy is a priority, consider reducing reliance on the Google ecosystem and switching to more privacy-focused alternatives (for example, proton.me and similar services). Google provides very strong security, but its services collect extensive telemetry for analysis. While this data is encrypted and not accessible to attackers, it may still be undesirable for users who value strict privacy.

''Note: Artificial intelligence tools, YubiKey, and other tools not directly related to Debian/Linux are mentioned here as optional technical aids, not as an endorsement of any specific service, vendor, or product. The author does not engage in commercial promotion of any software, hardware, or services, but merely provides optional recommendations for measures that directly or indirectly enhance the security of operating system usage.''

6. Use a Wi-Fi router that supports nftables or an equivalent modern packet-filtering framework.

It is not recommended to rely on the cheapest consumer-grade routers that lack built-in security mechanisms and fine-grained traffic filtering capabilities. A router should be treated as an integral part of the overall security architecture, not as an element that increases the attack surface.

Deploying an additional network filtering layer at the entry point of a home network significantly complicates an attacker’s ability to build an effective attack configuration and increases the overall cost of an attack. Configure strict and well-defined filtering rules on the router’s nftables firewall, including inbound connection restrictions, outbound traffic control, and network segmentation where appropriate.

Access to the router’s administrative interface must be protected with a strong, unique password. Whenever possible, management access should be restricted to trusted networks or limited to wired interfaces only.

Such a configuration provides an additional layer of protection not only for the primary workstation, but also for other devices connected to the network (for example, Android-based mobile devices), which often lack the technical capability to use host-level packet filtering mechanisms such as iptables or nftables.

7. It is also important to consider the possibility of hardware-level attacks.
Although such attacks are significantly less common and typically require more resources than software-based attacks, they remain a potential threat. In certain scenarios, an adversary may exploit vulnerabilities in device firmware or conduct a combined attack targeting both software and hardware layers. Examples include remote injection of malicious code into the firmware of a motherboard, router, optical modem, or other hardware components.

If, after a thorough software-level audit, a security issue remains unresolved, it is advisable '''to perform a hardware-level assessment''' as well, including verification of device firmware integrity and configuration.

'''And most importantly — give up the illusion of complete security. We live in conditions of a severe information war, and everyone must make efforts so that malicious actors cannot freely spy on desktops and servers.'''

===== Examples of Deep Custom Security Configurations =====

Below are examples of strong, individualized configurations for '''SELinux''', '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

====== SELinux config: ======
<syntaxhighlight lang="terminfo">
root@user:/home/user# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
root@user:/home/user# sestatus -v
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

Process contexts:
Current context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Init context: system_u:system_r:init_t:s0
/sbin/agetty system_u:system_r:getty_t:s0

File contexts:
Controlling terminal: unconfined_u:object_r:user_devpts_t:s0
/etc/passwd system_u:object_r:etc_t:s0
/etc/shadow system_u:object_r:unlabeled_t:s0
/bin/bash system_u:object_r:shell_exec_t:s0
/bin/login system_u:object_r:login_exec_t:s0
/bin/sh system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0
/sbin/agetty system_u:object_r:getty_exec_t:s0
/sbin/init system_u:object_r:bin_t:s0 -> system_u:object_r:init_exec_t:s0
/lib/ld-linux.so.2 system_u:object_r:lib_t:s0 -> system_u:object_r:ld_so_t:s0
</syntaxhighlight>

====== nftables config: ======
<syntaxhighlight lang="bash">
#!/usr/sbin/nft -f

flush ruleset

table inet filter {

# = Main chain policy =
chain input {
type filter hook input priority 0;
policy drop;

# = Common rule set =
# 🌀 Allow loopback interface (internal system processes)
iif "lo" accept

# == 🔁 Allow established and related connections ==
ct state established,related accept

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# == 🔒 Limit the rate of NEW connections per source IP (basic anti-DDoS protection) ==
# If you experience issues with slow or failed page loads in your browser,
# try increasing the limit, for example:
# ip saddr 0.0.0.0/0 ct state new limit rate 50/second burst 100 packets accept
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == 🚫 Blocking SSDP and mDNS (local broadcast discovery protocols) ==
ip daddr 239.255.255.250 udp dport 1900 drop # ❌ SSDP (UPnP/device discovery)
ip daddr 224.0.0.251 udp dport 5353 drop # ❌ mDNS (Bonjour, Avahi)

# == 🛑 Blocking NetBIOS and LLMNR (Windows/systemd internal LAN protocols) ==
udp dport 137 drop # ❌ NetBIOS Name Service (Windows network names)
udp dport 138 drop # ❌ NetBIOS Datagram Service (LAN name discovery)
udp dport 5355 drop # ❌ LLMNR (Link-Local Multicast Name Resolution)

# = Set of blocked IP addresses and ranges =

# == 🧱 Blocking known botnets and proxy networks ==
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} log prefix "🔥 BAN: known bots " flags all
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} drop

# == 🚫 Blocking strange TCP flags (XMAS, NULL scans and others) ==
tcp flags & (fin|syn|rst|psh|ack|urg) == 0 drop # NULL scan
tcp flags & (fin|psh|urg) == (fin|psh|urg) drop # XMAS scan
tcp flags & (fin|syn) == (fin|syn) drop # SYN-ACK scan
tcp flags & (syn|rst|fin) == (syn|rst|fin) drop # Xmas scan
tcp flags & (syn|fin|rst|psh|ack) == (syn|rst|fin|ack) drop # Xmas scan

# == 🚫 Blocking fragmented packets — commonly used in filter evasion ==
ip frag-off & 0x1fff != 0 drop

# == 🔒 Blocking spoofed IP packets ==
ip saddr 127.0.0.0/8 drop # localhost
ip saddr 10.0.0.0/8 drop # private network
ip saddr 172.16.0.0/12 drop # private network
ip saddr 192.168.0.0/16 drop # private network
ip saddr 169.254.0.0/16 drop # APIPA
ip saddr 0.0.0.0/8 drop # invalid address
ip saddr 224.0.0.0/4 drop # multicast
ip saddr 240.0.0.0/5 drop # reserved
}

# = Main chain policy =
chain forward {
type filter hook forward priority 0;
policy accept;

# = Blocking various types of attacks =
# Required in chain forward only if Docker or Oracle VirtualBox is present.
# If needed — uncomment.

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
# ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
# ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
# ip protocol icmp icmp type echo-request limit rate 1/second accept
# ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
# ip protocol icmp icmp type echo-request drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports required for application operation ==
tcp dport {
53, # DNS — needed for domain name resolution
80, # HTTP — web traffic, updates and resource loading
443, # HTTPS — secure web traffic, VPN, browser
12043, # Custom 3D Application — specific client port
13000-13050 # Custom 3D Application — dynamic client port range
} accept

# == Allow UDP ports required for application operation ==
udp dport {
53, # DNS — needed for domain name resolution
443, # HTTPS via QUIC/HTTP3, browser protocols
3478, # STUN/TURN — WebRTC and video calls
3479-3481 # STUN/TURN — WebRTC and video calls
} accept

# = Blocking dangerous and unnecessary TCP/UDP ports and ranges =

# These blocklists are intended for a DESKTOP / workstation.
# They block remote access, outdated services, proxies, DBs, IoT, and ports
# often used by malware, scanners, and C2 infrastructures.
#
# ⚠ If you use the system as a SERVER, enable IP forwarding,
# or run services with internal routing
# (Docker NAT/bridge, VirtualBox host-only/bridged, VPN clients),
# carefully review the blocked ports/ranges in the forward chain —
# these services may need extra ports.
# Adjust or comment out required items if necessary.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high risk) ===
22, # SSH — common brute-force target
23, # Telnet — outdated, no encryption
3389, # RDP — Windows remote desktop
5900, # VNC — remote access, frequent vulnerabilities
# === FTP / SMB / NetBIOS (unsafe file-sharing protocols) ===
21, # FTP — insecure protocol
137, # NetBIOS Name Service
138, # NetBIOS Datagram
139, # NetBIOS Session
445, # SMB/CIFS — common exploit target
# === Databases (NEVER expose to the Internet) ===
3306, # MySQL/MariaDB
1433, # MS SQL Server
1434, # MS SQL Browser
# === HTTP-alt/Proxy/Elasticsearch (exploited frequently) ===
8080, # HTTP proxy / web interfaces — often exposed accidentally
9200, # Elasticsearch API — full remote data access
# === UPnP/IoT (insecure by design) ===
1900, # SSDP / UPnP
# === Common for malware (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell
5555, # Android ADB / IoT botnets
9001, # Tor transport (used by malware)
1234, # Netcat / reverse connections
1337, # Common C2 port used by malware
# === ⚠️ Scanner ports and potentially vulnerable services ===
1080, # SOCKS proxy — used to bypass filtering
3128, # Squid proxy — may be abused as open proxy
8000, # Alternative HTTP ports, dev servers
8888, # Web interfaces, proxies, dev tools
10000 # Webmin — remote admin panel, frequent attacks
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; abused by attackers
162 # SNMP Trap — also potentially vulnerable
} drop

# Attention! Blocking wide port ranges — be careful!
# Do not break system or application functionality!

# == TCP port ranges not used by a workstation during transit routing ==
# Blocked to prevent unwanted forwarding, hidden tunnels,
# NAT evasion, parasitic flows, and potential forward-path attacks.

tcp dport {
1024-2047, # System/legacy services; rarely needed in forward
2048-4095, # Proprietary daemons; NFS (2049) — check if used
4096-8191, # Old VPNs, some games, P2P; rarely needed on desktop
8192-12287, # Alternative HTTP/proxy, multimedia; test as needed
12288-16383, # Media/VoIP (TCP fallback); may break calls
16384-24575, # RTP/WebRTC (TCP fallback); block unless AV needed
24576-32767, # Dynamic ranges for games/VPN; may cause issues
32768-49151, # Registered/ephemeral; risky — may break NAT, Docker, VM
49152-65535 # High ephemeral; widely used by modern apps
} drop

# == 🚫 Blocking UDP ports — high and dynamic ranges ==
udp dport {
1024-9999, # low/mid ephemeral ports; used by trojans, P2P, games, VPN
10000-65535 # high ephemeral; used by dynamic apps, VPN, Docker
} drop

# = 🕷️ Suspicious IPs — large ranges often used by botnets, spam nets, and scanners =
ip saddr {
185.0.0.0/8, # abused hosting and proxy networks
37.0.0.0/8, # cheap VPS, frequent scanning sources
88.0.0.0/8, # common brute-force and scanner range
77.0.0.0/8, # TOR/proxy nodes
91.0.0.0/8 # botnets and “grey-zone” hosting
} drop
}

chain output {
# = Main chain policy =
type filter hook output priority 0;
policy accept;

# = Blocking various types of attacks =

# == 🔒 Limiting new connections from a single IP (anti-DDoS) ==
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# = ICMP protocol restrictions =

# == 🛡️ Ping limitation ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == Critically important ICMP for network ==
ip protocol icmp icmp type { destination-unreachable, time-exceeded, parameter-problem } accept

# == Important ICMPv6 for IPv6 ==
ip6 nexthdr icmpv6 icmpv6 type { 1, 2, 3, 4 } accept
ip6 nexthdr icmpv6 icmpv6 type { 135, 136 } accept # NS/NA
ip6 nexthdr icmpv6 icmpv6 type { 133, 134 } accept # RS/RA

# == Drop all other ICMP and ICMPv6 ==
ip protocol icmp drop # drop all other ICMP
ip6 nexthdr icmpv6 drop # drop all other ICMPv6

# = SCTP protocol blocking =
# 99.9% of desktop systems do not use SCTP at all
meta l4proto sctp drop

# = DCCP — Datagram Congestion Control Protocol blocking =
# Not used by any mainstream desktop applications
meta l4proto dccp drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports and ranges required for application functionality ==
tcp dport {
53, # DNS client. Required for Internet to work: domain name resolution (UDP/TCP).
80, # HTTP traffic to unencrypted websites; apps may use it for API/redirects.
443, # HTTPS. Main port for all encrypted web traffic — browsers, API, VPN, updates.
3306, # MySQL client. Needed if you connect to MySQL.
3478, # STUN/TURN WebRTC. Needed for audio/video/Discord.
3000, # Node.js dev servers. Needed for development.
3690, # SVN. If you work with an old repository.
4443, # Alternative HTTPS (some APIs). Also used by some VPN/clients.
12043, # Required for Custom 3D Application.
13000-13050 # Required for Custom 3D Application.
} accept

# == Allow UDP ports and ranges required for applications ==
udp dport {
443, # Required for fast and stable operation of modern websites
# (Google, YouTube, ChatGPT, Cloudflare)
13000-13050 # Required for Custom 3D Application.
} accept

# = Blocking potentially dangerous / unnecessary TCP/UDP ports =

# These blocks are intended for a DESKTOP / workstation.
# ⚠ If you use the system as a SERVER —
# adjust or comment out the required ports/ranges as needed.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high-risk) ===
22, # SSH — target of brute-force attacks.
23, # Telnet — outdated, unencrypted.
3389, # RDP — Windows remote access.
5900, # VNC — remote access, often vulnerable.
# === FTP / SMB / NetBIOS (dangerous file-sharing services) ===
21, # FTP — insecure protocol.
137, # NetBIOS Name Service.
138, # NetBIOS Datagram.
139, # NetBIOS Session.
445, # SMB/CIFS — frequent exploitation target.
# === Databases (NEVER open to the Internet) ===
3306, # MySQL/MariaDB.
1433, # MS SQL Server.
1434, # MS SQL Browser.
# === HTTP-alt/Proxy/Elasticsearch (dangerous, often attacked) ===
8080, # HTTP proxy / web interfaces — often exposed test interfaces.
9200, # Elasticsearch API — full remote access to data.
# === UPnP/IoT (vulnerable by design) ===
1900, # SSDP / UPnP.
# === Common malware ports (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell.
5555, # Android ADB / IoT botnets.
9001, # Tor transport (used by malware).
1234, # Netcat / reverse connections.
1337, # Common C2 malware port.
# === ⚠️ Ports of scanners and potentially vulnerable services ===
1080, # SOCKS proxy — often abused for bypassing filters.
3128, # Squid HTTP proxy — can be used as open proxy.
8000, # Alternative HTTP ports, web services — potentially vulnerable.
8888, # Alternative web interfaces — test and proxy ports.
10000 # Webmin — web admin panel, target of attacks.
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; can be abused by attackers.
162 # SNMP Trap — same, potential vulnerability.
} drop

# Warning! ⚠️ Be careful blocking wide port ranges! ⚠️
# Do not break system or application functionality!
# If you need a range — uncomment.
# If you don’t — comment out.

# == Blocking “dangerous” and desktop-unnecessary TCP port ranges ==
tcp dport {
1-1023, # 🛑 Privileged ports.
1024-2047, # r-commands (rlogin, rsh, rexec), old RPC, NFS, legacy daemons.
2048-3071, # Rare proprietary protocols and middleware.
3072-4999, # Mostly ports of legacy, server, corporate apps;
# rarely needed on workstations.
5000-5999, # Alternative services, old P2P/admin ports, rarely used on desktops.
7000-7999, # Alternative/test ports, often used by trojans.
9000-9999, # Web services, proxies, possible backdoor ports.
10000-19998, # Dynamic/high service ports; may be required by some apps like Custom 3D Application,
# but not needed by most desktop services.
19999-32767 # Old ephemeral port range; used by P2P, games, some VPNs,
# but system services rarely use them.
} drop

# == Blocking “dangerous” and desktop-unnecessary UDP port ranges ==
udp dport {
1024-2047, # Old UNIX services, RPC, NFS, r-commands, legacy daemons.
# Usually safe to block.
2048-4095, # Rarely used standard ports, proprietary services.
# Usually safe to block.
4096-8191, # VPN, games, P2P, WebRTC, VoIP of some clients.
# Can block, but cautiously: may affect VPN/apps.
8192-12287, # QUIC/HTTP3, proxies, multimedia protocols.
# Might cause side effects; better test first.
12288-16383, # Old RTP/VoIP ranges and media streams.
# Can block, but might break video calls.
16384-24575, # Main RTP range (audio/video), WebRTC, VoIP.
# ❗ Do not block if you need video calls/WebRTC/VPN.
24576-32767 # Dynamic ports for VPN, P2P, games, streaming data.
# ❗ May break VPN or some apps.
} drop

# == 🕷️ Blocking suspicious IPs —
# large ranges often used by botnets, spam networks, and scanners ==
ip saddr {
185.0.0.0/8, # Abused hosting and proxy networks.
37.0.0.0/8, # Cheap VPS, scanning sources.
88.0.0.0/8, # Frequent brute-force and scanners.
77.0.0.0/8, # Massive TOR/proxy nodes.
91.0.0.0/8 # Botnets and “grey” hosting.
} drop
}
}

</syntaxhighlight>

====== sysctl config: ======
kernel parameters configuration

/etc/sysctl.d/99-protect.conf<syntaxhighlight lang="bash">
# 1 Ignore ICMP on interfaces
net.ipv4.icmp_echo_ignore_all = 1

# 2 Do not respond to ICMP broadcast (against Smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 3 Enable SYN backlog reduction
net.ipv4.tcp_syncookies = 1

# 4 Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 5 Log packets with incorrect routing
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# 6 Disable ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# 7 Disable packet forwarding
net.ipv4.ip_forward = 0

# 8 Disable IPv6 support
net.ipv4.conf.all.disable_ipv6 = 1
net.ipv4.conf.default.disable_ipv6 = 1

# 9 Prevent sending TCP segments with null windows
net.ipv4.tcp_rfc1337 = 1

# 10 Disable ARP filtering for automatic routing
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1

# 11 Limit the maximum size of the incoming TCP window
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# 12 Drop packets with incorrect checksums
net.ipv4.conf.all.drop_unicast_in_l2_multicast = 1
net.ipv4.conf.default.drop_unicast_in_l2_multicast = 1

# 13 Disable IPv6 forwarding
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# 14 Limit the maximum number of SYN packet retries
net.ipv4.tcp_synack_retries = 2

# 15 Increase routing cache lifetime
net.ipv4.route.max_size = 32768
</syntaxhighlight>

====== auditd rules config: ======
/etc/audit/rules.d/audit.rules

<syntaxhighlight lang="bash">
## Flush rules
-D

## Buffers
-b 8192
--backlog_wait_time 60000
-f 1

## Network audit
-a always,exit -F arch=b64 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b64 -S accept4 -F success=1 -k network_accept
-a always,exit -F arch=b32 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b32 -S accept4 -F success=1 -k network_accept

## Logging execve commands
-a always,exit -F arch=b64 -S execve -F key=exec_log

## Audit logins and sessions
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session

## sudo / su
-w /etc/sudoers -p wa -k sudo
-w /etc/sudoers.d/ -p wa -k sudo
-w /bin/su -p x -k su_cmd

## Account and configuration changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/hosts -p wa -k system_conf
-w /etc/hostname -p wa -k system_conf
-w /etc/resolv.conf -p wa -k system_conf
-w /etc/issue -p wa -k system_conf
-w /etc/network/ -p wa -k system_conf

## Time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -F key=time_change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -F key=time_change

## Audit SSH connections and changes
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /var/log/auth.log -p wa -k ssh_login

## Audit usage of remote tools (e.g., SSH, netcat)
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/nc -k nc_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/nc -k nc_process

## Audit privileged access
-a always,exit -F arch=b64 -S setuid -S setgid -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -S setgid -k privilege_escalation
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/sudoers.d/ -p wa -k sudoers_changes
-w /bin/sudo -p x -k sudo_command

## Monitor credential changes
#-w /root/.ssh/ -p wa -k ssh_keys
#-w /home/*/.ssh/ -p wa -k ssh_keys

## Audit use of remote network services
-a always,exit -F arch=b64 -S socket -F success=1 -k socket_connect
-a always,exit -F arch=b32 -S socket -F success=1 -k socket_connect

# Log package installation and removal via dpkg
-w /usr/bin/dpkg -p x
-w /usr/sbin/apt-get -p x
-w /usr/bin/apt -p x
</syntaxhighlight>

==== UsefulPrograms ====

Here is the list of programs useful for configuring and maintaining the security of Linux systems. The included programs are either open-source (the majority) or commercial, but with freely available limited features sufficient to address core security tasks (a smaller portion).

https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/UsefulPrograms

==== External Resources ====

[https://www.debian.org/doc/manuals/securing-debian-manual/index.en.html|Securing Debian Manual 3.19 — Javier Fernández-Sanguino Peña.]
This document describes security in the Debian project and in the Debian operating system. Starting with the process of securing and hardening the default Debian GNU/Linux distribution installation, it also covers some of the common tasks to set up a secure network environment using Debian GNU/Linux, gives additional information on the security tools available and talks about how security is enforced in Debian by the security and audit team.

[https://medium.com/%40ihouelecaurcy/the-complete-nftables-guide-modern-linux-firewall-mastery-79fb86894d5c|The Complete nftables Guide: Modern Linux Firewall Mastery — Ihouele Caurcy]
The definitive guide to nftables — the modern replacement for iptables, ip6tables, arptables, and ebtables. From basic concepts to enterprise-level configurations.

[https://notes.suhaib.in/docs/tech/utilities/iptables-nftables-and-you-a-friendly-guide-to-traffic-rules/|iptables, nftables, and You A Friendly Guide to Traffic Rules]
A friendly guide to iptables and nftables in Linux: explains Netfilter architecture, tables, chains and rules, with configuration examples (SSH, IP blocking, port forwarding). Covers differences between iptables and nftables, migration, and compatibility with modern firewall tools. Useful for understanding the iptables→nftables transition and practical examples.

[https://public.jdstone1.com/books_and_magazines/Computer_Books/Operating_Systems/SELinux%20System%20Administration%20(3rd%20ed).pdf|SELinux System Administration Third Edition — Sven Vermeulen.]
Implement mandatory access control to secure applications, users, and information flows on Linux.

[https://gitlab.com/apparmor/apparmor/-/wikis/home AppArmor]
The official wiki for the AppArmor security project on Linux. Provides guidance for users and developers, instructions for creating and managing security profiles, example access policies for applications, and best practices to protect the operating system.

[https://nallino.net/stockage/security/Linux_Mint_Security.pdf|Security, Privacy and Anonymity in Linux Mint — Michel Nallino.]
A good and comprehensive work on Linux Mint security that can also be useful for other Linux distributions.

[https://www.cisa.gov/topics/cybersecurity-best-practices|CISA — Cybersecurity Best Practices]
CISA (Certified Information Systems Auditor) provides information on cybersecurity best practices to help individuals and organizations implement preventative measures and manage cyber risks.

==== Provenance ====

This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131

it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks

[[index.php?title=Category:Security]]
[[index.php?title=Category:Hardening]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2025-12-18T19:30:47Z

Blackcat568: /* Related Aspects of Internet Security */

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.
* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

''Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build).''

Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

====== Main Aspects of System Hardening ======

1. Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.

2. If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to type long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>

3. Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.

4. Avoid using the superuser account or sudo without a clear necessity — and never execute arbitrary scripts with sudo. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
* Always read a script fully before running it (less script.sh, cat script.sh).
* Never paste commands from untrusted or unverified sources into the terminal.
* Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
* Follow the principle of least privilege — create separate user accounts and limit access rights where possible <blockquote>'''Important:''' Improper or careless use of sudo and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.</blockquote>

5. Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. You may also consider switching to SELinux. If you have difficulty configuring AppArmor or SELinux, seek help from specialists or use AI-based tools. My SELinux configuration is attached below (I use SELinux on Debian 12 — it works reliably).

6. Use advanced network filtering settings: iptables or nftables, or a commercial firewall. (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#nftables config:|nftables config]]

7. Configure kernel parameters for maximum security (sysctl hardening). (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#sysctl config:|sysctl config]])

8. Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event). (sample [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#auditd rules config:|auditd rules config]]

9. Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.

10 If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.

11. Follow the principle of Attack Surface Reduction (or [https://en.wikipedia.org/wiki/Occam's_razor Occam's Razor]) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
* If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
* If you are certain you will never use it, remove it completely from the system.
* This practice reduces potential attack vectors and strengthens overall system security.
* Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications.
* Always create a full system backup before making any significant configuration changes or modifications.

12. Perform regular antivirus and anti-rootkit scans of the system. In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.

13. Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:

<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>

Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

====== Related Aspects of Internet Security ======

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

1. Store passwords in a reliable password manager. '''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:

* relying on human memory, with the risk of forgetting or confusing credentials;
* storing passwords on paper media, which can be damaged, lost, or stolen;
* saving passwords in web browsers in unencrypted form;
* keeping passwords in plain text files on the desktop or in other directories without encryption;
* and similar approaches.
Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.

A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.

Regularly create up-to-date backups of the ''encrypted'' password database.

Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.

Additional Practical Recommendations: <blockquote>A password manager (for example, [https://keepassxc.org/ KeePassXC]) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.

In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.

It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).</blockquote>

2. Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [https://en.wikipedia.org/wiki/Authenticator_app Authenticator app]), or a hardware security key such as a [https://en.wikipedia.org/wiki/YubiKey YubiKey].

The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:
* YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
* It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
* Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number.

For now, it is one of the most reliable hardware-based options for two-factor authentication.

3. Using VPN to improve privacy and security

* ''If you are a private user'', you can also configure a system-wide VPN (for example, ProtonVPN) so that all device traffic is routed through it — not only browser traffic or traffic from specific applications.
Enable the “killswitch” mode and disable it only when necessary, re-enabling it immediately afterwards.
It is also recommended to periodically change VPN servers, doing so at different and unpredictable intervals.

Using a VPN increases your privacy: all of your traffic will be encrypted from observers on your local network and from your internet service provider. This makes it more difficult for an attacker to apply certain social-engineering methods based on traffic analysis, and it also helps protect your privacy in the event that your provider’s infrastructure is compromised.

* ''If you own a server'' and want access to it to be available only to trusted private or legal entities, while also increasing its protection against unauthorized access, you can configure the server so that SSH and other internal services are accessible exclusively through OpenVPN [https://openvpn.net/as-docs/tutorials/tutorial--change-tls-control-channel-security.html using TLS authentication (tls-auth / tls-crypt)] and unique client certificates instead of passwords.

4. Actively study and apply artificial intelligence to improve security configurations in Debian and other Linux distributions, as well as to address related cybersecurity tasks. A lack of knowledge often becomes the weakest link; AI can provide accurate, structured recommendations interactively and help automate repetitive or complex operations.

{{{#!wiki note
Always verify AI-generated recommendations before applying them in production environments. Test any changes in an isolated system, review generated commands or configurations, and ensure that suggestions align with your threat model and security architecture.
In practice, users who effectively leverage AI tools are significantly better prepared, and the adoption of such technologies makes malicious activity considerably more difficult for attackers.
}}}

5. If privacy is a priority, consider reducing reliance on the Google ecosystem and switching to more privacy-focused alternatives (for example, proton.me and similar services). Google provides very strong security, but its services collect extensive telemetry for analysis. While this data is encrypted and not accessible to attackers, it may still be undesirable for users who value strict privacy.

''Note: Artificial intelligence tools, YubiKey, and other tools not directly related to Debian/Linux are mentioned here as optional technical aids, not as an endorsement of any specific service, vendor, or product. The author does not engage in commercial promotion of any software, hardware, or services, but merely provides optional recommendations for measures that directly or indirectly enhance the security of operating system usage.''

6. It is also important to consider the possibility of hardware-level attacks.
Although such attacks are significantly less common and typically require more resources than software-based attacks, they remain a potential threat. In certain scenarios, an adversary may exploit vulnerabilities in device firmware or conduct a combined attack targeting both software and hardware layers. Examples include remote injection of malicious code into the firmware of a motherboard, router, optical modem, or other hardware components.

If, after a thorough software-level audit, a security issue remains unresolved, it is advisable '''to perform a hardware-level assessment''' as well, including verification of device firmware integrity and configuration.

'''And most importantly — give up the illusion of complete security. We live in conditions of a severe information war, and everyone must make efforts so that malicious actors cannot freely spy on desktops and servers.'''

===== Examples of Deep Custom Security Configurations =====

Below are examples of strong, individualized configurations for '''SELinux''', '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

====== SELinux config: ======
<syntaxhighlight lang="terminfo">
root@user:/home/user# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
root@user:/home/user# sestatus -v
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

Process contexts:
Current context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Init context: system_u:system_r:init_t:s0
/sbin/agetty system_u:system_r:getty_t:s0

File contexts:
Controlling terminal: unconfined_u:object_r:user_devpts_t:s0
/etc/passwd system_u:object_r:etc_t:s0
/etc/shadow system_u:object_r:unlabeled_t:s0
/bin/bash system_u:object_r:shell_exec_t:s0
/bin/login system_u:object_r:login_exec_t:s0
/bin/sh system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0
/sbin/agetty system_u:object_r:getty_exec_t:s0
/sbin/init system_u:object_r:bin_t:s0 -> system_u:object_r:init_exec_t:s0
/lib/ld-linux.so.2 system_u:object_r:lib_t:s0 -> system_u:object_r:ld_so_t:s0
</syntaxhighlight>

====== nftables config: ======
<syntaxhighlight lang="bash">
#!/usr/sbin/nft -f

flush ruleset

table inet filter {

# = Main chain policy =
chain input {
type filter hook input priority 0;
policy drop;

# = Common rule set =
# 🌀 Allow loopback interface (internal system processes)
iif "lo" accept

# == 🔁 Allow established and related connections ==
ct state established,related accept

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# == 🔒 Limit the rate of NEW connections per source IP (basic anti-DDoS protection) ==
# If you experience issues with slow or failed page loads in your browser,
# try increasing the limit, for example:
# ip saddr 0.0.0.0/0 ct state new limit rate 50/second burst 100 packets accept
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == 🚫 Blocking SSDP and mDNS (local broadcast discovery protocols) ==
ip daddr 239.255.255.250 udp dport 1900 drop # ❌ SSDP (UPnP/device discovery)
ip daddr 224.0.0.251 udp dport 5353 drop # ❌ mDNS (Bonjour, Avahi)

# == 🛑 Blocking NetBIOS and LLMNR (Windows/systemd internal LAN protocols) ==
udp dport 137 drop # ❌ NetBIOS Name Service (Windows network names)
udp dport 138 drop # ❌ NetBIOS Datagram Service (LAN name discovery)
udp dport 5355 drop # ❌ LLMNR (Link-Local Multicast Name Resolution)

# = Set of blocked IP addresses and ranges =

# == 🧱 Blocking known botnets and proxy networks ==
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} log prefix "🔥 BAN: known bots " flags all
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} drop

# == 🚫 Blocking strange TCP flags (XMAS, NULL scans and others) ==
tcp flags & (fin|syn|rst|psh|ack|urg) == 0 drop # NULL scan
tcp flags & (fin|psh|urg) == (fin|psh|urg) drop # XMAS scan
tcp flags & (fin|syn) == (fin|syn) drop # SYN-ACK scan
tcp flags & (syn|rst|fin) == (syn|rst|fin) drop # Xmas scan
tcp flags & (syn|fin|rst|psh|ack) == (syn|rst|fin|ack) drop # Xmas scan

# == 🚫 Blocking fragmented packets — commonly used in filter evasion ==
ip frag-off & 0x1fff != 0 drop

# == 🔒 Blocking spoofed IP packets ==
ip saddr 127.0.0.0/8 drop # localhost
ip saddr 10.0.0.0/8 drop # private network
ip saddr 172.16.0.0/12 drop # private network
ip saddr 192.168.0.0/16 drop # private network
ip saddr 169.254.0.0/16 drop # APIPA
ip saddr 0.0.0.0/8 drop # invalid address
ip saddr 224.0.0.0/4 drop # multicast
ip saddr 240.0.0.0/5 drop # reserved
}

# = Main chain policy =
chain forward {
type filter hook forward priority 0;
policy accept;

# = Blocking various types of attacks =
# Required in chain forward only if Docker or Oracle VirtualBox is present.
# If needed — uncomment.

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
# ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
# ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
# ip protocol icmp icmp type echo-request limit rate 1/second accept
# ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
# ip protocol icmp icmp type echo-request drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports required for application operation ==
tcp dport {
53, # DNS — needed for domain name resolution
80, # HTTP — web traffic, updates and resource loading
443, # HTTPS — secure web traffic, VPN, browser
12043, # Custom 3D Application — specific client port
13000-13050 # Custom 3D Application — dynamic client port range
} accept

# == Allow UDP ports required for application operation ==
udp dport {
53, # DNS — needed for domain name resolution
443, # HTTPS via QUIC/HTTP3, browser protocols
3478, # STUN/TURN — WebRTC and video calls
3479-3481 # STUN/TURN — WebRTC and video calls
} accept

# = Blocking dangerous and unnecessary TCP/UDP ports and ranges =

# These blocklists are intended for a DESKTOP / workstation.
# They block remote access, outdated services, proxies, DBs, IoT, and ports
# often used by malware, scanners, and C2 infrastructures.
#
# ⚠ If you use the system as a SERVER, enable IP forwarding,
# or run services with internal routing
# (Docker NAT/bridge, VirtualBox host-only/bridged, VPN clients),
# carefully review the blocked ports/ranges in the forward chain —
# these services may need extra ports.
# Adjust or comment out required items if necessary.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high risk) ===
22, # SSH — common brute-force target
23, # Telnet — outdated, no encryption
3389, # RDP — Windows remote desktop
5900, # VNC — remote access, frequent vulnerabilities
# === FTP / SMB / NetBIOS (unsafe file-sharing protocols) ===
21, # FTP — insecure protocol
137, # NetBIOS Name Service
138, # NetBIOS Datagram
139, # NetBIOS Session
445, # SMB/CIFS — common exploit target
# === Databases (NEVER expose to the Internet) ===
3306, # MySQL/MariaDB
1433, # MS SQL Server
1434, # MS SQL Browser
# === HTTP-alt/Proxy/Elasticsearch (exploited frequently) ===
8080, # HTTP proxy / web interfaces — often exposed accidentally
9200, # Elasticsearch API — full remote data access
# === UPnP/IoT (insecure by design) ===
1900, # SSDP / UPnP
# === Common for malware (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell
5555, # Android ADB / IoT botnets
9001, # Tor transport (used by malware)
1234, # Netcat / reverse connections
1337, # Common C2 port used by malware
# === ⚠️ Scanner ports and potentially vulnerable services ===
1080, # SOCKS proxy — used to bypass filtering
3128, # Squid proxy — may be abused as open proxy
8000, # Alternative HTTP ports, dev servers
8888, # Web interfaces, proxies, dev tools
10000 # Webmin — remote admin panel, frequent attacks
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; abused by attackers
162 # SNMP Trap — also potentially vulnerable
} drop

# Attention! Blocking wide port ranges — be careful!
# Do not break system or application functionality!

# == TCP port ranges not used by a workstation during transit routing ==
# Blocked to prevent unwanted forwarding, hidden tunnels,
# NAT evasion, parasitic flows, and potential forward-path attacks.

tcp dport {
1024-2047, # System/legacy services; rarely needed in forward
2048-4095, # Proprietary daemons; NFS (2049) — check if used
4096-8191, # Old VPNs, some games, P2P; rarely needed on desktop
8192-12287, # Alternative HTTP/proxy, multimedia; test as needed
12288-16383, # Media/VoIP (TCP fallback); may break calls
16384-24575, # RTP/WebRTC (TCP fallback); block unless AV needed
24576-32767, # Dynamic ranges for games/VPN; may cause issues
32768-49151, # Registered/ephemeral; risky — may break NAT, Docker, VM
49152-65535 # High ephemeral; widely used by modern apps
} drop

# == 🚫 Blocking UDP ports — high and dynamic ranges ==
udp dport {
1024-9999, # low/mid ephemeral ports; used by trojans, P2P, games, VPN
10000-65535 # high ephemeral; used by dynamic apps, VPN, Docker
} drop

# = 🕷️ Suspicious IPs — large ranges often used by botnets, spam nets, and scanners =
ip saddr {
185.0.0.0/8, # abused hosting and proxy networks
37.0.0.0/8, # cheap VPS, frequent scanning sources
88.0.0.0/8, # common brute-force and scanner range
77.0.0.0/8, # TOR/proxy nodes
91.0.0.0/8 # botnets and “grey-zone” hosting
} drop
}

chain output {
# = Main chain policy =
type filter hook output priority 0;
policy accept;

# = Blocking various types of attacks =

# == 🔒 Limiting new connections from a single IP (anti-DDoS) ==
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# = ICMP protocol restrictions =

# == 🛡️ Ping limitation ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == Critically important ICMP for network ==
ip protocol icmp icmp type { destination-unreachable, time-exceeded, parameter-problem } accept

# == Important ICMPv6 for IPv6 ==
ip6 nexthdr icmpv6 icmpv6 type { 1, 2, 3, 4 } accept
ip6 nexthdr icmpv6 icmpv6 type { 135, 136 } accept # NS/NA
ip6 nexthdr icmpv6 icmpv6 type { 133, 134 } accept # RS/RA

# == Drop all other ICMP and ICMPv6 ==
ip protocol icmp drop # drop all other ICMP
ip6 nexthdr icmpv6 drop # drop all other ICMPv6

# = SCTP protocol blocking =
# 99.9% of desktop systems do not use SCTP at all
meta l4proto sctp drop

# = DCCP — Datagram Congestion Control Protocol blocking =
# Not used by any mainstream desktop applications
meta l4proto dccp drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports and ranges required for application functionality ==
tcp dport {
53, # DNS client. Required for Internet to work: domain name resolution (UDP/TCP).
80, # HTTP traffic to unencrypted websites; apps may use it for API/redirects.
443, # HTTPS. Main port for all encrypted web traffic — browsers, API, VPN, updates.
3306, # MySQL client. Needed if you connect to MySQL.
3478, # STUN/TURN WebRTC. Needed for audio/video/Discord.
3000, # Node.js dev servers. Needed for development.
3690, # SVN. If you work with an old repository.
4443, # Alternative HTTPS (some APIs). Also used by some VPN/clients.
12043, # Required for Custom 3D Application.
13000-13050 # Required for Custom 3D Application.
} accept

# == Allow UDP ports and ranges required for applications ==
udp dport {
443, # Required for fast and stable operation of modern websites
# (Google, YouTube, ChatGPT, Cloudflare)
13000-13050 # Required for Custom 3D Application.
} accept

# = Blocking potentially dangerous / unnecessary TCP/UDP ports =

# These blocks are intended for a DESKTOP / workstation.
# ⚠ If you use the system as a SERVER —
# adjust or comment out the required ports/ranges as needed.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high-risk) ===
22, # SSH — target of brute-force attacks.
23, # Telnet — outdated, unencrypted.
3389, # RDP — Windows remote access.
5900, # VNC — remote access, often vulnerable.
# === FTP / SMB / NetBIOS (dangerous file-sharing services) ===
21, # FTP — insecure protocol.
137, # NetBIOS Name Service.
138, # NetBIOS Datagram.
139, # NetBIOS Session.
445, # SMB/CIFS — frequent exploitation target.
# === Databases (NEVER open to the Internet) ===
3306, # MySQL/MariaDB.
1433, # MS SQL Server.
1434, # MS SQL Browser.
# === HTTP-alt/Proxy/Elasticsearch (dangerous, often attacked) ===
8080, # HTTP proxy / web interfaces — often exposed test interfaces.
9200, # Elasticsearch API — full remote access to data.
# === UPnP/IoT (vulnerable by design) ===
1900, # SSDP / UPnP.
# === Common malware ports (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell.
5555, # Android ADB / IoT botnets.
9001, # Tor transport (used by malware).
1234, # Netcat / reverse connections.
1337, # Common C2 malware port.
# === ⚠️ Ports of scanners and potentially vulnerable services ===
1080, # SOCKS proxy — often abused for bypassing filters.
3128, # Squid HTTP proxy — can be used as open proxy.
8000, # Alternative HTTP ports, web services — potentially vulnerable.
8888, # Alternative web interfaces — test and proxy ports.
10000 # Webmin — web admin panel, target of attacks.
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; can be abused by attackers.
162 # SNMP Trap — same, potential vulnerability.
} drop

# Warning! ⚠️ Be careful blocking wide port ranges! ⚠️
# Do not break system or application functionality!
# If you need a range — uncomment.
# If you don’t — comment out.

# == Blocking “dangerous” and desktop-unnecessary TCP port ranges ==
tcp dport {
1-1023, # 🛑 Privileged ports.
1024-2047, # r-commands (rlogin, rsh, rexec), old RPC, NFS, legacy daemons.
2048-3071, # Rare proprietary protocols and middleware.
3072-4999, # Mostly ports of legacy, server, corporate apps;
# rarely needed on workstations.
5000-5999, # Alternative services, old P2P/admin ports, rarely used on desktops.
7000-7999, # Alternative/test ports, often used by trojans.
9000-9999, # Web services, proxies, possible backdoor ports.
10000-19998, # Dynamic/high service ports; may be required by some apps like Custom 3D Application,
# but not needed by most desktop services.
19999-32767 # Old ephemeral port range; used by P2P, games, some VPNs,
# but system services rarely use them.
} drop

# == Blocking “dangerous” and desktop-unnecessary UDP port ranges ==
udp dport {
1024-2047, # Old UNIX services, RPC, NFS, r-commands, legacy daemons.
# Usually safe to block.
2048-4095, # Rarely used standard ports, proprietary services.
# Usually safe to block.
4096-8191, # VPN, games, P2P, WebRTC, VoIP of some clients.
# Can block, but cautiously: may affect VPN/apps.
8192-12287, # QUIC/HTTP3, proxies, multimedia protocols.
# Might cause side effects; better test first.
12288-16383, # Old RTP/VoIP ranges and media streams.
# Can block, but might break video calls.
16384-24575, # Main RTP range (audio/video), WebRTC, VoIP.
# ❗ Do not block if you need video calls/WebRTC/VPN.
24576-32767 # Dynamic ports for VPN, P2P, games, streaming data.
# ❗ May break VPN or some apps.
} drop

# == 🕷️ Blocking suspicious IPs —
# large ranges often used by botnets, spam networks, and scanners ==
ip saddr {
185.0.0.0/8, # Abused hosting and proxy networks.
37.0.0.0/8, # Cheap VPS, scanning sources.
88.0.0.0/8, # Frequent brute-force and scanners.
77.0.0.0/8, # Massive TOR/proxy nodes.
91.0.0.0/8 # Botnets and “grey” hosting.
} drop
}
}

</syntaxhighlight>

====== sysctl config: ======
kernel parameters configuration

/etc/sysctl.d/99-protect.conf<syntaxhighlight lang="bash">
# 1 Ignore ICMP on interfaces
net.ipv4.icmp_echo_ignore_all = 1

# 2 Do not respond to ICMP broadcast (against Smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 3 Enable SYN backlog reduction
net.ipv4.tcp_syncookies = 1

# 4 Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 5 Log packets with incorrect routing
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# 6 Disable ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# 7 Disable packet forwarding
net.ipv4.ip_forward = 0

# 8 Disable IPv6 support
net.ipv4.conf.all.disable_ipv6 = 1
net.ipv4.conf.default.disable_ipv6 = 1

# 9 Prevent sending TCP segments with null windows
net.ipv4.tcp_rfc1337 = 1

# 10 Disable ARP filtering for automatic routing
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1

# 11 Limit the maximum size of the incoming TCP window
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# 12 Drop packets with incorrect checksums
net.ipv4.conf.all.drop_unicast_in_l2_multicast = 1
net.ipv4.conf.default.drop_unicast_in_l2_multicast = 1

# 13 Disable IPv6 forwarding
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# 14 Limit the maximum number of SYN packet retries
net.ipv4.tcp_synack_retries = 2

# 15 Increase routing cache lifetime
net.ipv4.route.max_size = 32768
</syntaxhighlight>

====== auditd rules config: ======
/etc/audit/rules.d/audit.rules

<syntaxhighlight lang="bash">
## Flush rules
-D

## Buffers
-b 8192
--backlog_wait_time 60000
-f 1

## Network audit
-a always,exit -F arch=b64 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b64 -S accept4 -F success=1 -k network_accept
-a always,exit -F arch=b32 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b32 -S accept4 -F success=1 -k network_accept

## Logging execve commands
-a always,exit -F arch=b64 -S execve -F key=exec_log

## Audit logins and sessions
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session

## sudo / su
-w /etc/sudoers -p wa -k sudo
-w /etc/sudoers.d/ -p wa -k sudo
-w /bin/su -p x -k su_cmd

## Account and configuration changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/hosts -p wa -k system_conf
-w /etc/hostname -p wa -k system_conf
-w /etc/resolv.conf -p wa -k system_conf
-w /etc/issue -p wa -k system_conf
-w /etc/network/ -p wa -k system_conf

## Time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -F key=time_change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -F key=time_change

## Audit SSH connections and changes
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /var/log/auth.log -p wa -k ssh_login

## Audit usage of remote tools (e.g., SSH, netcat)
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/nc -k nc_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/nc -k nc_process

## Audit privileged access
-a always,exit -F arch=b64 -S setuid -S setgid -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -S setgid -k privilege_escalation
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/sudoers.d/ -p wa -k sudoers_changes
-w /bin/sudo -p x -k sudo_command

## Monitor credential changes
#-w /root/.ssh/ -p wa -k ssh_keys
#-w /home/*/.ssh/ -p wa -k ssh_keys

## Audit use of remote network services
-a always,exit -F arch=b64 -S socket -F success=1 -k socket_connect
-a always,exit -F arch=b32 -S socket -F success=1 -k socket_connect

# Log package installation and removal via dpkg
-w /usr/bin/dpkg -p x
-w /usr/sbin/apt-get -p x
-w /usr/bin/apt -p x
</syntaxhighlight>

==== UsefulPrograms ====

Here is the list of programs useful for configuring and maintaining the security of Linux systems. The included programs are either open-source (the majority) or commercial, but with freely available limited features sufficient to address core security tasks (a smaller portion).

https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/UsefulPrograms

==== External Resources ====

[https://www.debian.org/doc/manuals/securing-debian-manual/index.en.html|Securing Debian Manual 3.19 — Javier Fernández-Sanguino Peña.]
This document describes security in the Debian project and in the Debian operating system. Starting with the process of securing and hardening the default Debian GNU/Linux distribution installation, it also covers some of the common tasks to set up a secure network environment using Debian GNU/Linux, gives additional information on the security tools available and talks about how security is enforced in Debian by the security and audit team.

[https://medium.com/%40ihouelecaurcy/the-complete-nftables-guide-modern-linux-firewall-mastery-79fb86894d5c|The Complete nftables Guide: Modern Linux Firewall Mastery — Ihouele Caurcy]
The definitive guide to nftables — the modern replacement for iptables, ip6tables, arptables, and ebtables. From basic concepts to enterprise-level configurations.

[https://notes.suhaib.in/docs/tech/utilities/iptables-nftables-and-you-a-friendly-guide-to-traffic-rules/|iptables, nftables, and You A Friendly Guide to Traffic Rules]
A friendly guide to iptables and nftables in Linux: explains Netfilter architecture, tables, chains and rules, with configuration examples (SSH, IP blocking, port forwarding). Covers differences between iptables and nftables, migration, and compatibility with modern firewall tools. Useful for understanding the iptables→nftables transition and practical examples.

[https://public.jdstone1.com/books_and_magazines/Computer_Books/Operating_Systems/SELinux%20System%20Administration%20(3rd%20ed).pdf|SELinux System Administration Third Edition — Sven Vermeulen.]
Implement mandatory access control to secure applications, users, and information flows on Linux.

[https://gitlab.com/apparmor/apparmor/-/wikis/home AppArmor]
The official wiki for the AppArmor security project on Linux. Provides guidance for users and developers, instructions for creating and managing security profiles, example access policies for applications, and best practices to protect the operating system.

[https://nallino.net/stockage/security/Linux_Mint_Security.pdf|Security, Privacy and Anonymity in Linux Mint — Michel Nallino.]
A good and comprehensive work on Linux Mint security that can also be useful for other Linux distributions.

[https://www.cisa.gov/topics/cybersecurity-best-practices|CISA — Cybersecurity Best Practices]
CISA (Certified Information Systems Auditor) provides information on cybersecurity best practices to help individuals and organizations implement preventative measures and manage cyber risks.

==== Provenance ====

This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131

it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks

[[index.php?title=Category:Security]]
[[index.php?title=Category:Hardening]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2025-12-18T19:16:14Z

Blackcat568: /* Related Aspects of Internet Security */

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.
* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

''Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build).''

Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

====== Main Aspects of System Hardening ======

1. Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.

2. If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to type long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>

3. Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.

4. Avoid using the superuser account or sudo without a clear necessity — and never execute arbitrary scripts with sudo. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
* Always read a script fully before running it (less script.sh, cat script.sh).
* Never paste commands from untrusted or unverified sources into the terminal.
* Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
* Follow the principle of least privilege — create separate user accounts and limit access rights where possible <blockquote>'''Important:''' Improper or careless use of sudo and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.</blockquote>

5. Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. You may also consider switching to SELinux. If you have difficulty configuring AppArmor or SELinux, seek help from specialists or use AI-based tools. My SELinux configuration is attached below (I use SELinux on Debian 12 — it works reliably).

6. Use advanced network filtering settings: iptables or nftables, or a commercial firewall. (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#nftables config:|nftables config]]

7. Configure kernel parameters for maximum security (sysctl hardening). (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#sysctl config:|sysctl config]])

8. Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event). (sample [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#auditd rules config:|auditd rules config]]

9. Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.

10 If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.

11. Follow the principle of Attack Surface Reduction (or [https://en.wikipedia.org/wiki/Occam's_razor Occam's Razor]) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
* If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
* If you are certain you will never use it, remove it completely from the system.
* This practice reduces potential attack vectors and strengthens overall system security.
* Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications.
* Always create a full system backup before making any significant configuration changes or modifications.

12. Perform regular antivirus and anti-rootkit scans of the system. In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.

13. Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:

<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>

Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

====== Related Aspects of Internet Security ======

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

1. Store passwords in a reliable password manager. '''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:

* relying on human memory, with the risk of forgetting or confusing credentials;
* storing passwords on paper media, which can be damaged, lost, or stolen;
* saving passwords in web browsers in unencrypted form;
* keeping passwords in plain text files on the desktop or in other directories without encryption;
* and similar approaches.
Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.

A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.

Regularly create up-to-date backups of the ''encrypted'' password database.

Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.

Additional Practical Recommendations

A password manager (for example, [https://keepassxc.org/ KeePassXC]) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.

In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.

It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).

2. Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [https://en.wikipedia.org/wiki/Authenticator_app Authenticator app]), or a hardware security key such as a [https://en.wikipedia.org/wiki/YubiKey YubiKey].

The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:
* YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
* It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
* Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number.

For now, it is one of the most reliable hardware-based options for two-factor authentication.

3. Using VPN to improve privacy and security

* ''If you are a private user'', you can also configure a system-wide VPN (for example, ProtonVPN) so that all device traffic is routed through it — not only browser traffic or traffic from specific applications.
Enable the “killswitch” mode and disable it only when necessary, re-enabling it immediately afterwards.
It is also recommended to periodically change VPN servers, doing so at different and unpredictable intervals.

Using a VPN increases your privacy: all of your traffic will be encrypted from observers on your local network and from your internet service provider. This makes it more difficult for an attacker to apply certain social-engineering methods based on traffic analysis, and it also helps protect your privacy in the event that your provider’s infrastructure is compromised.

* ''If you own a server'' and want access to it to be available only to trusted private or legal entities, while also increasing its protection against unauthorized access, you can configure the server so that SSH and other internal services are accessible exclusively through OpenVPN [https://openvpn.net/as-docs/tutorials/tutorial--change-tls-control-channel-security.html using TLS authentication (tls-auth / tls-crypt)] and unique client certificates instead of passwords.

4. Actively study and apply artificial intelligence to improve security configurations in Debian and other Linux distributions, as well as to address related cybersecurity tasks. A lack of knowledge often becomes the weakest link; AI can provide accurate, structured recommendations interactively and help automate repetitive or complex operations.

{{{#!wiki note
Always verify AI-generated recommendations before applying them in production environments. Test any changes in an isolated system, review generated commands or configurations, and ensure that suggestions align with your threat model and security architecture.
In practice, users who effectively leverage AI tools are significantly better prepared, and the adoption of such technologies makes malicious activity considerably more difficult for attackers.
}}}

5. If privacy is a priority, consider reducing reliance on the Google ecosystem and switching to more privacy-focused alternatives (for example, proton.me and similar services). Google provides very strong security, but its services collect extensive telemetry for analysis. While this data is encrypted and not accessible to attackers, it may still be undesirable for users who value strict privacy.

''Note: Artificial intelligence tools, YubiKey, and other tools not directly related to Debian/Linux are mentioned here as optional technical aids, not as an endorsement of any specific service, vendor, or product. The author does not engage in commercial promotion of any software, hardware, or services, but merely provides optional recommendations for measures that directly or indirectly enhance the security of operating system usage.''

6. It is also important to consider the possibility of hardware-level attacks.
Although such attacks are significantly less common and typically require more resources than software-based attacks, they remain a potential threat. In certain scenarios, an adversary may exploit vulnerabilities in device firmware or conduct a combined attack targeting both software and hardware layers. Examples include remote injection of malicious code into the firmware of a motherboard, router, optical modem, or other hardware components.

If, after a thorough software-level audit, a security issue remains unresolved, it is advisable '''to perform a hardware-level assessment''' as well, including verification of device firmware integrity and configuration.

'''And most importantly — give up the illusion of complete security. We live in conditions of a severe information war, and everyone must make efforts so that malicious actors cannot freely spy on desktops and servers.'''

===== Examples of Deep Custom Security Configurations =====

Below are examples of strong, individualized configurations for '''SELinux''', '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

====== SELinux config: ======
<syntaxhighlight lang="terminfo">
root@user:/home/user# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
root@user:/home/user# sestatus -v
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

Process contexts:
Current context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Init context: system_u:system_r:init_t:s0
/sbin/agetty system_u:system_r:getty_t:s0

File contexts:
Controlling terminal: unconfined_u:object_r:user_devpts_t:s0
/etc/passwd system_u:object_r:etc_t:s0
/etc/shadow system_u:object_r:unlabeled_t:s0
/bin/bash system_u:object_r:shell_exec_t:s0
/bin/login system_u:object_r:login_exec_t:s0
/bin/sh system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0
/sbin/agetty system_u:object_r:getty_exec_t:s0
/sbin/init system_u:object_r:bin_t:s0 -> system_u:object_r:init_exec_t:s0
/lib/ld-linux.so.2 system_u:object_r:lib_t:s0 -> system_u:object_r:ld_so_t:s0
</syntaxhighlight>

====== nftables config: ======
<syntaxhighlight lang="bash">
#!/usr/sbin/nft -f

flush ruleset

table inet filter {

# = Main chain policy =
chain input {
type filter hook input priority 0;
policy drop;

# = Common rule set =
# 🌀 Allow loopback interface (internal system processes)
iif "lo" accept

# == 🔁 Allow established and related connections ==
ct state established,related accept

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# == 🔒 Limit the rate of NEW connections per source IP (basic anti-DDoS protection) ==
# If you experience issues with slow or failed page loads in your browser,
# try increasing the limit, for example:
# ip saddr 0.0.0.0/0 ct state new limit rate 50/second burst 100 packets accept
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == 🚫 Blocking SSDP and mDNS (local broadcast discovery protocols) ==
ip daddr 239.255.255.250 udp dport 1900 drop # ❌ SSDP (UPnP/device discovery)
ip daddr 224.0.0.251 udp dport 5353 drop # ❌ mDNS (Bonjour, Avahi)

# == 🛑 Blocking NetBIOS and LLMNR (Windows/systemd internal LAN protocols) ==
udp dport 137 drop # ❌ NetBIOS Name Service (Windows network names)
udp dport 138 drop # ❌ NetBIOS Datagram Service (LAN name discovery)
udp dport 5355 drop # ❌ LLMNR (Link-Local Multicast Name Resolution)

# = Set of blocked IP addresses and ranges =

# == 🧱 Blocking known botnets and proxy networks ==
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} log prefix "🔥 BAN: known bots " flags all
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} drop

# == 🚫 Blocking strange TCP flags (XMAS, NULL scans and others) ==
tcp flags & (fin|syn|rst|psh|ack|urg) == 0 drop # NULL scan
tcp flags & (fin|psh|urg) == (fin|psh|urg) drop # XMAS scan
tcp flags & (fin|syn) == (fin|syn) drop # SYN-ACK scan
tcp flags & (syn|rst|fin) == (syn|rst|fin) drop # Xmas scan
tcp flags & (syn|fin|rst|psh|ack) == (syn|rst|fin|ack) drop # Xmas scan

# == 🚫 Blocking fragmented packets — commonly used in filter evasion ==
ip frag-off & 0x1fff != 0 drop

# == 🔒 Blocking spoofed IP packets ==
ip saddr 127.0.0.0/8 drop # localhost
ip saddr 10.0.0.0/8 drop # private network
ip saddr 172.16.0.0/12 drop # private network
ip saddr 192.168.0.0/16 drop # private network
ip saddr 169.254.0.0/16 drop # APIPA
ip saddr 0.0.0.0/8 drop # invalid address
ip saddr 224.0.0.0/4 drop # multicast
ip saddr 240.0.0.0/5 drop # reserved
}

# = Main chain policy =
chain forward {
type filter hook forward priority 0;
policy accept;

# = Blocking various types of attacks =
# Required in chain forward only if Docker or Oracle VirtualBox is present.
# If needed — uncomment.

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
# ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
# ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
# ip protocol icmp icmp type echo-request limit rate 1/second accept
# ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
# ip protocol icmp icmp type echo-request drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports required for application operation ==
tcp dport {
53, # DNS — needed for domain name resolution
80, # HTTP — web traffic, updates and resource loading
443, # HTTPS — secure web traffic, VPN, browser
12043, # Custom 3D Application — specific client port
13000-13050 # Custom 3D Application — dynamic client port range
} accept

# == Allow UDP ports required for application operation ==
udp dport {
53, # DNS — needed for domain name resolution
443, # HTTPS via QUIC/HTTP3, browser protocols
3478, # STUN/TURN — WebRTC and video calls
3479-3481 # STUN/TURN — WebRTC and video calls
} accept

# = Blocking dangerous and unnecessary TCP/UDP ports and ranges =

# These blocklists are intended for a DESKTOP / workstation.
# They block remote access, outdated services, proxies, DBs, IoT, and ports
# often used by malware, scanners, and C2 infrastructures.
#
# ⚠ If you use the system as a SERVER, enable IP forwarding,
# or run services with internal routing
# (Docker NAT/bridge, VirtualBox host-only/bridged, VPN clients),
# carefully review the blocked ports/ranges in the forward chain —
# these services may need extra ports.
# Adjust or comment out required items if necessary.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high risk) ===
22, # SSH — common brute-force target
23, # Telnet — outdated, no encryption
3389, # RDP — Windows remote desktop
5900, # VNC — remote access, frequent vulnerabilities
# === FTP / SMB / NetBIOS (unsafe file-sharing protocols) ===
21, # FTP — insecure protocol
137, # NetBIOS Name Service
138, # NetBIOS Datagram
139, # NetBIOS Session
445, # SMB/CIFS — common exploit target
# === Databases (NEVER expose to the Internet) ===
3306, # MySQL/MariaDB
1433, # MS SQL Server
1434, # MS SQL Browser
# === HTTP-alt/Proxy/Elasticsearch (exploited frequently) ===
8080, # HTTP proxy / web interfaces — often exposed accidentally
9200, # Elasticsearch API — full remote data access
# === UPnP/IoT (insecure by design) ===
1900, # SSDP / UPnP
# === Common for malware (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell
5555, # Android ADB / IoT botnets
9001, # Tor transport (used by malware)
1234, # Netcat / reverse connections
1337, # Common C2 port used by malware
# === ⚠️ Scanner ports and potentially vulnerable services ===
1080, # SOCKS proxy — used to bypass filtering
3128, # Squid proxy — may be abused as open proxy
8000, # Alternative HTTP ports, dev servers
8888, # Web interfaces, proxies, dev tools
10000 # Webmin — remote admin panel, frequent attacks
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; abused by attackers
162 # SNMP Trap — also potentially vulnerable
} drop

# Attention! Blocking wide port ranges — be careful!
# Do not break system or application functionality!

# == TCP port ranges not used by a workstation during transit routing ==
# Blocked to prevent unwanted forwarding, hidden tunnels,
# NAT evasion, parasitic flows, and potential forward-path attacks.

tcp dport {
1024-2047, # System/legacy services; rarely needed in forward
2048-4095, # Proprietary daemons; NFS (2049) — check if used
4096-8191, # Old VPNs, some games, P2P; rarely needed on desktop
8192-12287, # Alternative HTTP/proxy, multimedia; test as needed
12288-16383, # Media/VoIP (TCP fallback); may break calls
16384-24575, # RTP/WebRTC (TCP fallback); block unless AV needed
24576-32767, # Dynamic ranges for games/VPN; may cause issues
32768-49151, # Registered/ephemeral; risky — may break NAT, Docker, VM
49152-65535 # High ephemeral; widely used by modern apps
} drop

# == 🚫 Blocking UDP ports — high and dynamic ranges ==
udp dport {
1024-9999, # low/mid ephemeral ports; used by trojans, P2P, games, VPN
10000-65535 # high ephemeral; used by dynamic apps, VPN, Docker
} drop

# = 🕷️ Suspicious IPs — large ranges often used by botnets, spam nets, and scanners =
ip saddr {
185.0.0.0/8, # abused hosting and proxy networks
37.0.0.0/8, # cheap VPS, frequent scanning sources
88.0.0.0/8, # common brute-force and scanner range
77.0.0.0/8, # TOR/proxy nodes
91.0.0.0/8 # botnets and “grey-zone” hosting
} drop
}

chain output {
# = Main chain policy =
type filter hook output priority 0;
policy accept;

# = Blocking various types of attacks =

# == 🔒 Limiting new connections from a single IP (anti-DDoS) ==
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# = ICMP protocol restrictions =

# == 🛡️ Ping limitation ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == Critically important ICMP for network ==
ip protocol icmp icmp type { destination-unreachable, time-exceeded, parameter-problem } accept

# == Important ICMPv6 for IPv6 ==
ip6 nexthdr icmpv6 icmpv6 type { 1, 2, 3, 4 } accept
ip6 nexthdr icmpv6 icmpv6 type { 135, 136 } accept # NS/NA
ip6 nexthdr icmpv6 icmpv6 type { 133, 134 } accept # RS/RA

# == Drop all other ICMP and ICMPv6 ==
ip protocol icmp drop # drop all other ICMP
ip6 nexthdr icmpv6 drop # drop all other ICMPv6

# = SCTP protocol blocking =
# 99.9% of desktop systems do not use SCTP at all
meta l4proto sctp drop

# = DCCP — Datagram Congestion Control Protocol blocking =
# Not used by any mainstream desktop applications
meta l4proto dccp drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports and ranges required for application functionality ==
tcp dport {
53, # DNS client. Required for Internet to work: domain name resolution (UDP/TCP).
80, # HTTP traffic to unencrypted websites; apps may use it for API/redirects.
443, # HTTPS. Main port for all encrypted web traffic — browsers, API, VPN, updates.
3306, # MySQL client. Needed if you connect to MySQL.
3478, # STUN/TURN WebRTC. Needed for audio/video/Discord.
3000, # Node.js dev servers. Needed for development.
3690, # SVN. If you work with an old repository.
4443, # Alternative HTTPS (some APIs). Also used by some VPN/clients.
12043, # Required for Custom 3D Application.
13000-13050 # Required for Custom 3D Application.
} accept

# == Allow UDP ports and ranges required for applications ==
udp dport {
443, # Required for fast and stable operation of modern websites
# (Google, YouTube, ChatGPT, Cloudflare)
13000-13050 # Required for Custom 3D Application.
} accept

# = Blocking potentially dangerous / unnecessary TCP/UDP ports =

# These blocks are intended for a DESKTOP / workstation.
# ⚠ If you use the system as a SERVER —
# adjust or comment out the required ports/ranges as needed.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high-risk) ===
22, # SSH — target of brute-force attacks.
23, # Telnet — outdated, unencrypted.
3389, # RDP — Windows remote access.
5900, # VNC — remote access, often vulnerable.
# === FTP / SMB / NetBIOS (dangerous file-sharing services) ===
21, # FTP — insecure protocol.
137, # NetBIOS Name Service.
138, # NetBIOS Datagram.
139, # NetBIOS Session.
445, # SMB/CIFS — frequent exploitation target.
# === Databases (NEVER open to the Internet) ===
3306, # MySQL/MariaDB.
1433, # MS SQL Server.
1434, # MS SQL Browser.
# === HTTP-alt/Proxy/Elasticsearch (dangerous, often attacked) ===
8080, # HTTP proxy / web interfaces — often exposed test interfaces.
9200, # Elasticsearch API — full remote access to data.
# === UPnP/IoT (vulnerable by design) ===
1900, # SSDP / UPnP.
# === Common malware ports (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell.
5555, # Android ADB / IoT botnets.
9001, # Tor transport (used by malware).
1234, # Netcat / reverse connections.
1337, # Common C2 malware port.
# === ⚠️ Ports of scanners and potentially vulnerable services ===
1080, # SOCKS proxy — often abused for bypassing filters.
3128, # Squid HTTP proxy — can be used as open proxy.
8000, # Alternative HTTP ports, web services — potentially vulnerable.
8888, # Alternative web interfaces — test and proxy ports.
10000 # Webmin — web admin panel, target of attacks.
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; can be abused by attackers.
162 # SNMP Trap — same, potential vulnerability.
} drop

# Warning! ⚠️ Be careful blocking wide port ranges! ⚠️
# Do not break system or application functionality!
# If you need a range — uncomment.
# If you don’t — comment out.

# == Blocking “dangerous” and desktop-unnecessary TCP port ranges ==
tcp dport {
1-1023, # 🛑 Privileged ports.
1024-2047, # r-commands (rlogin, rsh, rexec), old RPC, NFS, legacy daemons.
2048-3071, # Rare proprietary protocols and middleware.
3072-4999, # Mostly ports of legacy, server, corporate apps;
# rarely needed on workstations.
5000-5999, # Alternative services, old P2P/admin ports, rarely used on desktops.
7000-7999, # Alternative/test ports, often used by trojans.
9000-9999, # Web services, proxies, possible backdoor ports.
10000-19998, # Dynamic/high service ports; may be required by some apps like Custom 3D Application,
# but not needed by most desktop services.
19999-32767 # Old ephemeral port range; used by P2P, games, some VPNs,
# but system services rarely use them.
} drop

# == Blocking “dangerous” and desktop-unnecessary UDP port ranges ==
udp dport {
1024-2047, # Old UNIX services, RPC, NFS, r-commands, legacy daemons.
# Usually safe to block.
2048-4095, # Rarely used standard ports, proprietary services.
# Usually safe to block.
4096-8191, # VPN, games, P2P, WebRTC, VoIP of some clients.
# Can block, but cautiously: may affect VPN/apps.
8192-12287, # QUIC/HTTP3, proxies, multimedia protocols.
# Might cause side effects; better test first.
12288-16383, # Old RTP/VoIP ranges and media streams.
# Can block, but might break video calls.
16384-24575, # Main RTP range (audio/video), WebRTC, VoIP.
# ❗ Do not block if you need video calls/WebRTC/VPN.
24576-32767 # Dynamic ports for VPN, P2P, games, streaming data.
# ❗ May break VPN or some apps.
} drop

# == 🕷️ Blocking suspicious IPs —
# large ranges often used by botnets, spam networks, and scanners ==
ip saddr {
185.0.0.0/8, # Abused hosting and proxy networks.
37.0.0.0/8, # Cheap VPS, scanning sources.
88.0.0.0/8, # Frequent brute-force and scanners.
77.0.0.0/8, # Massive TOR/proxy nodes.
91.0.0.0/8 # Botnets and “grey” hosting.
} drop
}
}

</syntaxhighlight>

====== sysctl config: ======
kernel parameters configuration

/etc/sysctl.d/99-protect.conf<syntaxhighlight lang="bash">
# 1 Ignore ICMP on interfaces
net.ipv4.icmp_echo_ignore_all = 1

# 2 Do not respond to ICMP broadcast (against Smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 3 Enable SYN backlog reduction
net.ipv4.tcp_syncookies = 1

# 4 Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 5 Log packets with incorrect routing
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# 6 Disable ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# 7 Disable packet forwarding
net.ipv4.ip_forward = 0

# 8 Disable IPv6 support
net.ipv4.conf.all.disable_ipv6 = 1
net.ipv4.conf.default.disable_ipv6 = 1

# 9 Prevent sending TCP segments with null windows
net.ipv4.tcp_rfc1337 = 1

# 10 Disable ARP filtering for automatic routing
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1

# 11 Limit the maximum size of the incoming TCP window
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# 12 Drop packets with incorrect checksums
net.ipv4.conf.all.drop_unicast_in_l2_multicast = 1
net.ipv4.conf.default.drop_unicast_in_l2_multicast = 1

# 13 Disable IPv6 forwarding
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# 14 Limit the maximum number of SYN packet retries
net.ipv4.tcp_synack_retries = 2

# 15 Increase routing cache lifetime
net.ipv4.route.max_size = 32768
</syntaxhighlight>

====== auditd rules config: ======
/etc/audit/rules.d/audit.rules

<syntaxhighlight lang="bash">
## Flush rules
-D

## Buffers
-b 8192
--backlog_wait_time 60000
-f 1

## Network audit
-a always,exit -F arch=b64 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b64 -S accept4 -F success=1 -k network_accept
-a always,exit -F arch=b32 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b32 -S accept4 -F success=1 -k network_accept

## Logging execve commands
-a always,exit -F arch=b64 -S execve -F key=exec_log

## Audit logins and sessions
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session

## sudo / su
-w /etc/sudoers -p wa -k sudo
-w /etc/sudoers.d/ -p wa -k sudo
-w /bin/su -p x -k su_cmd

## Account and configuration changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/hosts -p wa -k system_conf
-w /etc/hostname -p wa -k system_conf
-w /etc/resolv.conf -p wa -k system_conf
-w /etc/issue -p wa -k system_conf
-w /etc/network/ -p wa -k system_conf

## Time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -F key=time_change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -F key=time_change

## Audit SSH connections and changes
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /var/log/auth.log -p wa -k ssh_login

## Audit usage of remote tools (e.g., SSH, netcat)
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/nc -k nc_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/nc -k nc_process

## Audit privileged access
-a always,exit -F arch=b64 -S setuid -S setgid -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -S setgid -k privilege_escalation
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/sudoers.d/ -p wa -k sudoers_changes
-w /bin/sudo -p x -k sudo_command

## Monitor credential changes
#-w /root/.ssh/ -p wa -k ssh_keys
#-w /home/*/.ssh/ -p wa -k ssh_keys

## Audit use of remote network services
-a always,exit -F arch=b64 -S socket -F success=1 -k socket_connect
-a always,exit -F arch=b32 -S socket -F success=1 -k socket_connect

# Log package installation and removal via dpkg
-w /usr/bin/dpkg -p x
-w /usr/sbin/apt-get -p x
-w /usr/bin/apt -p x
</syntaxhighlight>

==== UsefulPrograms ====

Here is the list of programs useful for configuring and maintaining the security of Linux systems. The included programs are either open-source (the majority) or commercial, but with freely available limited features sufficient to address core security tasks (a smaller portion).

https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/UsefulPrograms

==== External Resources ====

[https://www.debian.org/doc/manuals/securing-debian-manual/index.en.html|Securing Debian Manual 3.19 — Javier Fernández-Sanguino Peña.]
This document describes security in the Debian project and in the Debian operating system. Starting with the process of securing and hardening the default Debian GNU/Linux distribution installation, it also covers some of the common tasks to set up a secure network environment using Debian GNU/Linux, gives additional information on the security tools available and talks about how security is enforced in Debian by the security and audit team.

[https://medium.com/%40ihouelecaurcy/the-complete-nftables-guide-modern-linux-firewall-mastery-79fb86894d5c|The Complete nftables Guide: Modern Linux Firewall Mastery — Ihouele Caurcy]
The definitive guide to nftables — the modern replacement for iptables, ip6tables, arptables, and ebtables. From basic concepts to enterprise-level configurations.

[https://notes.suhaib.in/docs/tech/utilities/iptables-nftables-and-you-a-friendly-guide-to-traffic-rules/|iptables, nftables, and You A Friendly Guide to Traffic Rules]
A friendly guide to iptables and nftables in Linux: explains Netfilter architecture, tables, chains and rules, with configuration examples (SSH, IP blocking, port forwarding). Covers differences between iptables and nftables, migration, and compatibility with modern firewall tools. Useful for understanding the iptables→nftables transition and practical examples.

[https://public.jdstone1.com/books_and_magazines/Computer_Books/Operating_Systems/SELinux%20System%20Administration%20(3rd%20ed).pdf|SELinux System Administration Third Edition — Sven Vermeulen.]
Implement mandatory access control to secure applications, users, and information flows on Linux.

[https://gitlab.com/apparmor/apparmor/-/wikis/home AppArmor]
The official wiki for the AppArmor security project on Linux. Provides guidance for users and developers, instructions for creating and managing security profiles, example access policies for applications, and best practices to protect the operating system.

[https://nallino.net/stockage/security/Linux_Mint_Security.pdf|Security, Privacy and Anonymity in Linux Mint — Michel Nallino.]
A good and comprehensive work on Linux Mint security that can also be useful for other Linux distributions.

[https://www.cisa.gov/topics/cybersecurity-best-practices|CISA — Cybersecurity Best Practices]
CISA (Certified Information Systems Auditor) provides information on cybersecurity best practices to help individuals and organizations implement preventative measures and manage cyber risks.

==== Provenance ====

This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131

it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks

[[index.php?title=Category:Security]]
[[index.php?title=Category:Hardening]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2025-12-18T19:12:14Z

Blackcat568:

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.
* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

''Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build).''

Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

====== Main Aspects of System Hardening ======

1. Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.

2. If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to type long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>

3. Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.

4. Avoid using the superuser account or sudo without a clear necessity — and never execute arbitrary scripts with sudo. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
* Always read a script fully before running it (less script.sh, cat script.sh).
* Never paste commands from untrusted or unverified sources into the terminal.
* Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
* Follow the principle of least privilege — create separate user accounts and limit access rights where possible <blockquote>'''Important:''' Improper or careless use of sudo and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.</blockquote>

5. Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. You may also consider switching to SELinux. If you have difficulty configuring AppArmor or SELinux, seek help from specialists or use AI-based tools. My SELinux configuration is attached below (I use SELinux on Debian 12 — it works reliably).

6. Use advanced network filtering settings: iptables or nftables, or a commercial firewall. (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#nftables config:|nftables config]]

7. Configure kernel parameters for maximum security (sysctl hardening). (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#sysctl config:|sysctl config]])

8. Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event). (sample [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#auditd rules config:|auditd rules config]]

9. Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.

10 If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.

11. Follow the principle of Attack Surface Reduction (or [https://en.wikipedia.org/wiki/Occam's_razor Occam's Razor]) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
* If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
* If you are certain you will never use it, remove it completely from the system.
* This practice reduces potential attack vectors and strengthens overall system security.
* Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications.
* Always create a full system backup before making any significant configuration changes or modifications.

12. Perform regular antivirus and anti-rootkit scans of the system. In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.

13. Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:

<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>

Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

====== Related Aspects of Internet Security ======

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

1. Store passwords in a reliable password manager. '''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:

* relying on human memory, with the risk of forgetting or confusing credentials;
* storing passwords on paper media, which can be damaged, lost, or stolen;
* saving passwords in web browsers in unencrypted form;
* keeping passwords in plain text files on the desktop or in other directories without encryption;
* and similar approaches.
Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.

A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.

Regularly create up-to-date backups of the ''encrypted'' password database.

Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.

Additional Practical Recommendations

A password manager (for example, [[https://keepassxc.org/%7CKeePassXC]]) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.

In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.

It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).

2. Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [[https://en.wikipedia.org/wiki/Authenticator_app|Authenticator app]]), or a hardware security key such as a [[https://en.wikipedia.org/wiki/YubiKey|YubiKey]].

The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:
* YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
* It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
* Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number.

For now, it is one of the most reliable hardware-based options for two-factor authentication.

3. Using VPN to improve privacy and security

* ''If you are a private user'', you can also configure a system-wide VPN (for example, ProtonVPN) so that all device traffic is routed through it — not only browser traffic or traffic from specific applications.
Enable the “killswitch” mode and disable it only when necessary, re-enabling it immediately afterwards.
It is also recommended to periodically change VPN servers, doing so at different and unpredictable intervals.

Using a VPN increases your privacy: all of your traffic will be encrypted from observers on your local network and from your internet service provider. This makes it more difficult for an attacker to apply certain social-engineering methods based on traffic analysis, and it also helps protect your privacy in the event that your provider’s infrastructure is compromised.

* ''If you own a server'' and want access to it to be available only to trusted private or legal entities, while also increasing its protection against unauthorized access, you can configure the server so that SSH and other internal services are accessible exclusively through OpenVPN [[https://openvpn.net/as-docs/tutorials/tutorial--change-tls-control-channel-security.html|using TLS authentication (tls-auth / tls-crypt)]] and unique client certificates instead of passwords.

4. Actively study and apply artificial intelligence to improve security configurations in Debian and other Linux distributions, as well as to address related cybersecurity tasks. A lack of knowledge often becomes the weakest link; AI can provide accurate, structured recommendations interactively and help automate repetitive or complex operations.

{{{#!wiki note
Always verify AI-generated recommendations before applying them in production environments. Test any changes in an isolated system, review generated commands or configurations, and ensure that suggestions align with your threat model and security architecture.
In practice, users who effectively leverage AI tools are significantly better prepared, and the adoption of such technologies makes malicious activity considerably more difficult for attackers.
}}}

5. If privacy is a priority, consider reducing reliance on the Google ecosystem and switching to more privacy-focused alternatives (for example, proton.me and similar services). Google provides very strong security, but its services collect extensive telemetry for analysis. While this data is encrypted and not accessible to attackers, it may still be undesirable for users who value strict privacy.

''Note: Artificial intelligence tools, YubiKey, and other tools not directly related to Debian/Linux are mentioned here as optional technical aids, not as an endorsement of any specific service, vendor, or product. The author does not engage in commercial promotion of any software, hardware, or services, but merely provides optional recommendations for measures that directly or indirectly enhance the security of operating system usage.''

6. It is also important to consider the possibility of hardware-level attacks.
Although such attacks are significantly less common and typically require more resources than software-based attacks, they remain a potential threat. In certain scenarios, an adversary may exploit vulnerabilities in device firmware or conduct a combined attack targeting both software and hardware layers. Examples include remote injection of malicious code into the firmware of a motherboard, router, optical modem, or other hardware components.

If, after a thorough software-level audit, a security issue remains unresolved, it is advisable '''to perform a hardware-level assessment''' as well, including verification of device firmware integrity and configuration.

'''And most importantly — give up the illusion of complete security. We live in conditions of a severe information war, and everyone must make efforts so that malicious actors cannot freely spy on desktops and servers.'''

===== Examples of Deep Custom Security Configurations =====

Below are examples of strong, individualized configurations for '''SELinux''', '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

====== SELinux config: ======
<syntaxhighlight lang="terminfo">
root@user:/home/user# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
root@user:/home/user# sestatus -v
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

Process contexts:
Current context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Init context: system_u:system_r:init_t:s0
/sbin/agetty system_u:system_r:getty_t:s0

File contexts:
Controlling terminal: unconfined_u:object_r:user_devpts_t:s0
/etc/passwd system_u:object_r:etc_t:s0
/etc/shadow system_u:object_r:unlabeled_t:s0
/bin/bash system_u:object_r:shell_exec_t:s0
/bin/login system_u:object_r:login_exec_t:s0
/bin/sh system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0
/sbin/agetty system_u:object_r:getty_exec_t:s0
/sbin/init system_u:object_r:bin_t:s0 -> system_u:object_r:init_exec_t:s0
/lib/ld-linux.so.2 system_u:object_r:lib_t:s0 -> system_u:object_r:ld_so_t:s0
</syntaxhighlight>

====== nftables config: ======
<syntaxhighlight lang="bash">
#!/usr/sbin/nft -f

flush ruleset

table inet filter {

# = Main chain policy =
chain input {
type filter hook input priority 0;
policy drop;

# = Common rule set =
# 🌀 Allow loopback interface (internal system processes)
iif "lo" accept

# == 🔁 Allow established and related connections ==
ct state established,related accept

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# == 🔒 Limit the rate of NEW connections per source IP (basic anti-DDoS protection) ==
# If you experience issues with slow or failed page loads in your browser,
# try increasing the limit, for example:
# ip saddr 0.0.0.0/0 ct state new limit rate 50/second burst 100 packets accept
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == 🚫 Blocking SSDP and mDNS (local broadcast discovery protocols) ==
ip daddr 239.255.255.250 udp dport 1900 drop # ❌ SSDP (UPnP/device discovery)
ip daddr 224.0.0.251 udp dport 5353 drop # ❌ mDNS (Bonjour, Avahi)

# == 🛑 Blocking NetBIOS and LLMNR (Windows/systemd internal LAN protocols) ==
udp dport 137 drop # ❌ NetBIOS Name Service (Windows network names)
udp dport 138 drop # ❌ NetBIOS Datagram Service (LAN name discovery)
udp dport 5355 drop # ❌ LLMNR (Link-Local Multicast Name Resolution)

# = Set of blocked IP addresses and ranges =

# == 🧱 Blocking known botnets and proxy networks ==
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} log prefix "🔥 BAN: known bots " flags all
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} drop

# == 🚫 Blocking strange TCP flags (XMAS, NULL scans and others) ==
tcp flags & (fin|syn|rst|psh|ack|urg) == 0 drop # NULL scan
tcp flags & (fin|psh|urg) == (fin|psh|urg) drop # XMAS scan
tcp flags & (fin|syn) == (fin|syn) drop # SYN-ACK scan
tcp flags & (syn|rst|fin) == (syn|rst|fin) drop # Xmas scan
tcp flags & (syn|fin|rst|psh|ack) == (syn|rst|fin|ack) drop # Xmas scan

# == 🚫 Blocking fragmented packets — commonly used in filter evasion ==
ip frag-off & 0x1fff != 0 drop

# == 🔒 Blocking spoofed IP packets ==
ip saddr 127.0.0.0/8 drop # localhost
ip saddr 10.0.0.0/8 drop # private network
ip saddr 172.16.0.0/12 drop # private network
ip saddr 192.168.0.0/16 drop # private network
ip saddr 169.254.0.0/16 drop # APIPA
ip saddr 0.0.0.0/8 drop # invalid address
ip saddr 224.0.0.0/4 drop # multicast
ip saddr 240.0.0.0/5 drop # reserved
}

# = Main chain policy =
chain forward {
type filter hook forward priority 0;
policy accept;

# = Blocking various types of attacks =
# Required in chain forward only if Docker or Oracle VirtualBox is present.
# If needed — uncomment.

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
# ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
# ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
# ip protocol icmp icmp type echo-request limit rate 1/second accept
# ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
# ip protocol icmp icmp type echo-request drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports required for application operation ==
tcp dport {
53, # DNS — needed for domain name resolution
80, # HTTP — web traffic, updates and resource loading
443, # HTTPS — secure web traffic, VPN, browser
12043, # Custom 3D Application — specific client port
13000-13050 # Custom 3D Application — dynamic client port range
} accept

# == Allow UDP ports required for application operation ==
udp dport {
53, # DNS — needed for domain name resolution
443, # HTTPS via QUIC/HTTP3, browser protocols
3478, # STUN/TURN — WebRTC and video calls
3479-3481 # STUN/TURN — WebRTC and video calls
} accept

# = Blocking dangerous and unnecessary TCP/UDP ports and ranges =

# These blocklists are intended for a DESKTOP / workstation.
# They block remote access, outdated services, proxies, DBs, IoT, and ports
# often used by malware, scanners, and C2 infrastructures.
#
# ⚠ If you use the system as a SERVER, enable IP forwarding,
# or run services with internal routing
# (Docker NAT/bridge, VirtualBox host-only/bridged, VPN clients),
# carefully review the blocked ports/ranges in the forward chain —
# these services may need extra ports.
# Adjust or comment out required items if necessary.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high risk) ===
22, # SSH — common brute-force target
23, # Telnet — outdated, no encryption
3389, # RDP — Windows remote desktop
5900, # VNC — remote access, frequent vulnerabilities
# === FTP / SMB / NetBIOS (unsafe file-sharing protocols) ===
21, # FTP — insecure protocol
137, # NetBIOS Name Service
138, # NetBIOS Datagram
139, # NetBIOS Session
445, # SMB/CIFS — common exploit target
# === Databases (NEVER expose to the Internet) ===
3306, # MySQL/MariaDB
1433, # MS SQL Server
1434, # MS SQL Browser
# === HTTP-alt/Proxy/Elasticsearch (exploited frequently) ===
8080, # HTTP proxy / web interfaces — often exposed accidentally
9200, # Elasticsearch API — full remote data access
# === UPnP/IoT (insecure by design) ===
1900, # SSDP / UPnP
# === Common for malware (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell
5555, # Android ADB / IoT botnets
9001, # Tor transport (used by malware)
1234, # Netcat / reverse connections
1337, # Common C2 port used by malware
# === ⚠️ Scanner ports and potentially vulnerable services ===
1080, # SOCKS proxy — used to bypass filtering
3128, # Squid proxy — may be abused as open proxy
8000, # Alternative HTTP ports, dev servers
8888, # Web interfaces, proxies, dev tools
10000 # Webmin — remote admin panel, frequent attacks
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; abused by attackers
162 # SNMP Trap — also potentially vulnerable
} drop

# Attention! Blocking wide port ranges — be careful!
# Do not break system or application functionality!

# == TCP port ranges not used by a workstation during transit routing ==
# Blocked to prevent unwanted forwarding, hidden tunnels,
# NAT evasion, parasitic flows, and potential forward-path attacks.

tcp dport {
1024-2047, # System/legacy services; rarely needed in forward
2048-4095, # Proprietary daemons; NFS (2049) — check if used
4096-8191, # Old VPNs, some games, P2P; rarely needed on desktop
8192-12287, # Alternative HTTP/proxy, multimedia; test as needed
12288-16383, # Media/VoIP (TCP fallback); may break calls
16384-24575, # RTP/WebRTC (TCP fallback); block unless AV needed
24576-32767, # Dynamic ranges for games/VPN; may cause issues
32768-49151, # Registered/ephemeral; risky — may break NAT, Docker, VM
49152-65535 # High ephemeral; widely used by modern apps
} drop

# == 🚫 Blocking UDP ports — high and dynamic ranges ==
udp dport {
1024-9999, # low/mid ephemeral ports; used by trojans, P2P, games, VPN
10000-65535 # high ephemeral; used by dynamic apps, VPN, Docker
} drop

# = 🕷️ Suspicious IPs — large ranges often used by botnets, spam nets, and scanners =
ip saddr {
185.0.0.0/8, # abused hosting and proxy networks
37.0.0.0/8, # cheap VPS, frequent scanning sources
88.0.0.0/8, # common brute-force and scanner range
77.0.0.0/8, # TOR/proxy nodes
91.0.0.0/8 # botnets and “grey-zone” hosting
} drop
}

chain output {
# = Main chain policy =
type filter hook output priority 0;
policy accept;

# = Blocking various types of attacks =

# == 🔒 Limiting new connections from a single IP (anti-DDoS) ==
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# = ICMP protocol restrictions =

# == 🛡️ Ping limitation ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == Critically important ICMP for network ==
ip protocol icmp icmp type { destination-unreachable, time-exceeded, parameter-problem } accept

# == Important ICMPv6 for IPv6 ==
ip6 nexthdr icmpv6 icmpv6 type { 1, 2, 3, 4 } accept
ip6 nexthdr icmpv6 icmpv6 type { 135, 136 } accept # NS/NA
ip6 nexthdr icmpv6 icmpv6 type { 133, 134 } accept # RS/RA

# == Drop all other ICMP and ICMPv6 ==
ip protocol icmp drop # drop all other ICMP
ip6 nexthdr icmpv6 drop # drop all other ICMPv6

# = SCTP protocol blocking =
# 99.9% of desktop systems do not use SCTP at all
meta l4proto sctp drop

# = DCCP — Datagram Congestion Control Protocol blocking =
# Not used by any mainstream desktop applications
meta l4proto dccp drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports and ranges required for application functionality ==
tcp dport {
53, # DNS client. Required for Internet to work: domain name resolution (UDP/TCP).
80, # HTTP traffic to unencrypted websites; apps may use it for API/redirects.
443, # HTTPS. Main port for all encrypted web traffic — browsers, API, VPN, updates.
3306, # MySQL client. Needed if you connect to MySQL.
3478, # STUN/TURN WebRTC. Needed for audio/video/Discord.
3000, # Node.js dev servers. Needed for development.
3690, # SVN. If you work with an old repository.
4443, # Alternative HTTPS (some APIs). Also used by some VPN/clients.
12043, # Required for Custom 3D Application.
13000-13050 # Required for Custom 3D Application.
} accept

# == Allow UDP ports and ranges required for applications ==
udp dport {
443, # Required for fast and stable operation of modern websites
# (Google, YouTube, ChatGPT, Cloudflare)
13000-13050 # Required for Custom 3D Application.
} accept

# = Blocking potentially dangerous / unnecessary TCP/UDP ports =

# These blocks are intended for a DESKTOP / workstation.
# ⚠ If you use the system as a SERVER —
# adjust or comment out the required ports/ranges as needed.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high-risk) ===
22, # SSH — target of brute-force attacks.
23, # Telnet — outdated, unencrypted.
3389, # RDP — Windows remote access.
5900, # VNC — remote access, often vulnerable.
# === FTP / SMB / NetBIOS (dangerous file-sharing services) ===
21, # FTP — insecure protocol.
137, # NetBIOS Name Service.
138, # NetBIOS Datagram.
139, # NetBIOS Session.
445, # SMB/CIFS — frequent exploitation target.
# === Databases (NEVER open to the Internet) ===
3306, # MySQL/MariaDB.
1433, # MS SQL Server.
1434, # MS SQL Browser.
# === HTTP-alt/Proxy/Elasticsearch (dangerous, often attacked) ===
8080, # HTTP proxy / web interfaces — often exposed test interfaces.
9200, # Elasticsearch API — full remote access to data.
# === UPnP/IoT (vulnerable by design) ===
1900, # SSDP / UPnP.
# === Common malware ports (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell.
5555, # Android ADB / IoT botnets.
9001, # Tor transport (used by malware).
1234, # Netcat / reverse connections.
1337, # Common C2 malware port.
# === ⚠️ Ports of scanners and potentially vulnerable services ===
1080, # SOCKS proxy — often abused for bypassing filters.
3128, # Squid HTTP proxy — can be used as open proxy.
8000, # Alternative HTTP ports, web services — potentially vulnerable.
8888, # Alternative web interfaces — test and proxy ports.
10000 # Webmin — web admin panel, target of attacks.
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; can be abused by attackers.
162 # SNMP Trap — same, potential vulnerability.
} drop

# Warning! ⚠️ Be careful blocking wide port ranges! ⚠️
# Do not break system or application functionality!
# If you need a range — uncomment.
# If you don’t — comment out.

# == Blocking “dangerous” and desktop-unnecessary TCP port ranges ==
tcp dport {
1-1023, # 🛑 Privileged ports.
1024-2047, # r-commands (rlogin, rsh, rexec), old RPC, NFS, legacy daemons.
2048-3071, # Rare proprietary protocols and middleware.
3072-4999, # Mostly ports of legacy, server, corporate apps;
# rarely needed on workstations.
5000-5999, # Alternative services, old P2P/admin ports, rarely used on desktops.
7000-7999, # Alternative/test ports, often used by trojans.
9000-9999, # Web services, proxies, possible backdoor ports.
10000-19998, # Dynamic/high service ports; may be required by some apps like Custom 3D Application,
# but not needed by most desktop services.
19999-32767 # Old ephemeral port range; used by P2P, games, some VPNs,
# but system services rarely use them.
} drop

# == Blocking “dangerous” and desktop-unnecessary UDP port ranges ==
udp dport {
1024-2047, # Old UNIX services, RPC, NFS, r-commands, legacy daemons.
# Usually safe to block.
2048-4095, # Rarely used standard ports, proprietary services.
# Usually safe to block.
4096-8191, # VPN, games, P2P, WebRTC, VoIP of some clients.
# Can block, but cautiously: may affect VPN/apps.
8192-12287, # QUIC/HTTP3, proxies, multimedia protocols.
# Might cause side effects; better test first.
12288-16383, # Old RTP/VoIP ranges and media streams.
# Can block, but might break video calls.
16384-24575, # Main RTP range (audio/video), WebRTC, VoIP.
# ❗ Do not block if you need video calls/WebRTC/VPN.
24576-32767 # Dynamic ports for VPN, P2P, games, streaming data.
# ❗ May break VPN or some apps.
} drop

# == 🕷️ Blocking suspicious IPs —
# large ranges often used by botnets, spam networks, and scanners ==
ip saddr {
185.0.0.0/8, # Abused hosting and proxy networks.
37.0.0.0/8, # Cheap VPS, scanning sources.
88.0.0.0/8, # Frequent brute-force and scanners.
77.0.0.0/8, # Massive TOR/proxy nodes.
91.0.0.0/8 # Botnets and “grey” hosting.
} drop
}
}

</syntaxhighlight>

====== sysctl config: ======
kernel parameters configuration

/etc/sysctl.d/99-protect.conf<syntaxhighlight lang="bash">
# 1 Ignore ICMP on interfaces
net.ipv4.icmp_echo_ignore_all = 1

# 2 Do not respond to ICMP broadcast (against Smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 3 Enable SYN backlog reduction
net.ipv4.tcp_syncookies = 1

# 4 Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 5 Log packets with incorrect routing
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# 6 Disable ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# 7 Disable packet forwarding
net.ipv4.ip_forward = 0

# 8 Disable IPv6 support
net.ipv4.conf.all.disable_ipv6 = 1
net.ipv4.conf.default.disable_ipv6 = 1

# 9 Prevent sending TCP segments with null windows
net.ipv4.tcp_rfc1337 = 1

# 10 Disable ARP filtering for automatic routing
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1

# 11 Limit the maximum size of the incoming TCP window
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# 12 Drop packets with incorrect checksums
net.ipv4.conf.all.drop_unicast_in_l2_multicast = 1
net.ipv4.conf.default.drop_unicast_in_l2_multicast = 1

# 13 Disable IPv6 forwarding
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# 14 Limit the maximum number of SYN packet retries
net.ipv4.tcp_synack_retries = 2

# 15 Increase routing cache lifetime
net.ipv4.route.max_size = 32768
</syntaxhighlight>

====== auditd rules config: ======
/etc/audit/rules.d/audit.rules

<syntaxhighlight lang="bash">
## Flush rules
-D

## Buffers
-b 8192
--backlog_wait_time 60000
-f 1

## Network audit
-a always,exit -F arch=b64 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b64 -S accept4 -F success=1 -k network_accept
-a always,exit -F arch=b32 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b32 -S accept4 -F success=1 -k network_accept

## Logging execve commands
-a always,exit -F arch=b64 -S execve -F key=exec_log

## Audit logins and sessions
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session

## sudo / su
-w /etc/sudoers -p wa -k sudo
-w /etc/sudoers.d/ -p wa -k sudo
-w /bin/su -p x -k su_cmd

## Account and configuration changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/hosts -p wa -k system_conf
-w /etc/hostname -p wa -k system_conf
-w /etc/resolv.conf -p wa -k system_conf
-w /etc/issue -p wa -k system_conf
-w /etc/network/ -p wa -k system_conf

## Time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -F key=time_change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -F key=time_change

## Audit SSH connections and changes
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /var/log/auth.log -p wa -k ssh_login

## Audit usage of remote tools (e.g., SSH, netcat)
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/nc -k nc_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/nc -k nc_process

## Audit privileged access
-a always,exit -F arch=b64 -S setuid -S setgid -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -S setgid -k privilege_escalation
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/sudoers.d/ -p wa -k sudoers_changes
-w /bin/sudo -p x -k sudo_command

## Monitor credential changes
#-w /root/.ssh/ -p wa -k ssh_keys
#-w /home/*/.ssh/ -p wa -k ssh_keys

## Audit use of remote network services
-a always,exit -F arch=b64 -S socket -F success=1 -k socket_connect
-a always,exit -F arch=b32 -S socket -F success=1 -k socket_connect

# Log package installation and removal via dpkg
-w /usr/bin/dpkg -p x
-w /usr/sbin/apt-get -p x
-w /usr/bin/apt -p x
</syntaxhighlight>

==== UsefulPrograms ====

Here is the list of programs useful for configuring and maintaining the security of Linux systems. The included programs are either open-source (the majority) or commercial, but with freely available limited features sufficient to address core security tasks (a smaller portion).

https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/UsefulPrograms

==== External Resources ====

[https://www.debian.org/doc/manuals/securing-debian-manual/index.en.html|Securing Debian Manual 3.19 — Javier Fernández-Sanguino Peña.]
This document describes security in the Debian project and in the Debian operating system. Starting with the process of securing and hardening the default Debian GNU/Linux distribution installation, it also covers some of the common tasks to set up a secure network environment using Debian GNU/Linux, gives additional information on the security tools available and talks about how security is enforced in Debian by the security and audit team.

[https://medium.com/%40ihouelecaurcy/the-complete-nftables-guide-modern-linux-firewall-mastery-79fb86894d5c|The Complete nftables Guide: Modern Linux Firewall Mastery — Ihouele Caurcy]
The definitive guide to nftables — the modern replacement for iptables, ip6tables, arptables, and ebtables. From basic concepts to enterprise-level configurations.

[https://notes.suhaib.in/docs/tech/utilities/iptables-nftables-and-you-a-friendly-guide-to-traffic-rules/|iptables, nftables, and You A Friendly Guide to Traffic Rules]
A friendly guide to iptables and nftables in Linux: explains Netfilter architecture, tables, chains and rules, with configuration examples (SSH, IP blocking, port forwarding). Covers differences between iptables and nftables, migration, and compatibility with modern firewall tools. Useful for understanding the iptables→nftables transition and practical examples.

[https://public.jdstone1.com/books_and_magazines/Computer_Books/Operating_Systems/SELinux%20System%20Administration%20(3rd%20ed).pdf|SELinux System Administration Third Edition — Sven Vermeulen.]
Implement mandatory access control to secure applications, users, and information flows on Linux.

[https://gitlab.com/apparmor/apparmor/-/wikis/home AppArmor]
The official wiki for the AppArmor security project on Linux. Provides guidance for users and developers, instructions for creating and managing security profiles, example access policies for applications, and best practices to protect the operating system.

[https://nallino.net/stockage/security/Linux_Mint_Security.pdf|Security, Privacy and Anonymity in Linux Mint — Michel Nallino.]
A good and comprehensive work on Linux Mint security that can also be useful for other Linux distributions.

[https://www.cisa.gov/topics/cybersecurity-best-practices|CISA — Cybersecurity Best Practices]
CISA (Certified Information Systems Auditor) provides information on cybersecurity best practices to help individuals and organizations implement preventative measures and manage cyber risks.

==== Provenance ====

This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131

it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks

[[index.php?title=Category:Security]]
[[index.php?title=Category:Hardening]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2025-12-18T18:57:22Z

Blackcat568: /* Related Aspects of Internet Security */

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.
* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

''Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build).''

Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

====== Main Aspects of System Hardening ======

# Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.
# If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to type long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>
# Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.
# Avoid using the superuser account or sudo without a clear necessity — and never execute arbitrary scripts with sudo. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
## Always read a script fully before running it (less script.sh, cat script.sh).
## Never paste commands from untrusted or unverified sources into the terminal.
## Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
## Follow the principle of least privilege — create separate user accounts and limit access rights where possible <blockquote>'''Important:''' Improper or careless use of sudo and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.</blockquote>
# Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. You may also consider switching to SELinux. If you have difficulty configuring AppArmor or SELinux, seek help from specialists or use AI-based tools. My SELinux configuration is attached below (I use SELinux on Debian 12 — it works reliably).
# Use advanced network filtering settings: iptables or nftables, or a commercial firewall. (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#nftables config:|nftables config]]
# Configure kernel parameters for maximum security (sysctl hardening). (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#sysctl config:|sysctl config]])
# Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event). (sample [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#auditd rules config:|auditd rules config]]
# Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.
# If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.
# Follow the principle of Attack Surface Reduction (or [https://en.wikipedia.org/wiki/Occam's_razor Occam's Razor]) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
## If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
## If you are certain you will never use it, remove it completely from the system.
## This practice reduces potential attack vectors and strengthens overall system security.
## Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications.
## Always create a full system backup before making any significant configuration changes or modifications.
# Perform regular antivirus and anti-rootkit scans of the system. In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.
# Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:
<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

====== Related Aspects of Internet Security ======

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

# Store passwords in a reliable password manager. '''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:

* relying on human memory, with the risk of forgetting or confusing credentials;
* storing passwords on paper media, which can be damaged, lost, or stolen;
* saving passwords in web browsers in unencrypted form;
* keeping passwords in plain text files on the desktop or in other directories without encryption;
* and similar approaches.
Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.

A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.

Regularly create up-to-date backups of the ''encrypted'' password database.

Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.

Additional Practical Recommendations

A password manager (for example, [[https://keepassxc.org/%7CKeePassXC]]) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.

In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.

It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).

# Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [[https://en.wikipedia.org/wiki/Authenticator_app|Authenticator app]]), or a hardware security key such as a [[https://en.wikipedia.org/wiki/YubiKey|YubiKey]].

The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:
* YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
* It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
* Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number.

For now, it is one of the most reliable hardware-based options for two-factor authentication.

===== Examples of Deep Custom Security Configurations =====

Below are examples of strong, individualized configurations for '''SELinux''', '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

====== SELinux config: ======
<syntaxhighlight lang="terminfo">
root@user:/home/user# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
root@user:/home/user# sestatus -v
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

Process contexts:
Current context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Init context: system_u:system_r:init_t:s0
/sbin/agetty system_u:system_r:getty_t:s0

File contexts:
Controlling terminal: unconfined_u:object_r:user_devpts_t:s0
/etc/passwd system_u:object_r:etc_t:s0
/etc/shadow system_u:object_r:unlabeled_t:s0
/bin/bash system_u:object_r:shell_exec_t:s0
/bin/login system_u:object_r:login_exec_t:s0
/bin/sh system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0
/sbin/agetty system_u:object_r:getty_exec_t:s0
/sbin/init system_u:object_r:bin_t:s0 -> system_u:object_r:init_exec_t:s0
/lib/ld-linux.so.2 system_u:object_r:lib_t:s0 -> system_u:object_r:ld_so_t:s0
</syntaxhighlight>

====== nftables config: ======
<syntaxhighlight lang="bash">
#!/usr/sbin/nft -f

flush ruleset

table inet filter {

# = Main chain policy =
chain input {
type filter hook input priority 0;
policy drop;

# = Common rule set =
# 🌀 Allow loopback interface (internal system processes)
iif "lo" accept

# == 🔁 Allow established and related connections ==
ct state established,related accept

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# == 🔒 Limit the rate of NEW connections per source IP (basic anti-DDoS protection) ==
# If you experience issues with slow or failed page loads in your browser,
# try increasing the limit, for example:
# ip saddr 0.0.0.0/0 ct state new limit rate 50/second burst 100 packets accept
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == 🚫 Blocking SSDP and mDNS (local broadcast discovery protocols) ==
ip daddr 239.255.255.250 udp dport 1900 drop # ❌ SSDP (UPnP/device discovery)
ip daddr 224.0.0.251 udp dport 5353 drop # ❌ mDNS (Bonjour, Avahi)

# == 🛑 Blocking NetBIOS and LLMNR (Windows/systemd internal LAN protocols) ==
udp dport 137 drop # ❌ NetBIOS Name Service (Windows network names)
udp dport 138 drop # ❌ NetBIOS Datagram Service (LAN name discovery)
udp dport 5355 drop # ❌ LLMNR (Link-Local Multicast Name Resolution)

# = Set of blocked IP addresses and ranges =

# == 🧱 Blocking known botnets and proxy networks ==
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} log prefix "🔥 BAN: known bots " flags all
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} drop

# == 🚫 Blocking strange TCP flags (XMAS, NULL scans and others) ==
tcp flags & (fin|syn|rst|psh|ack|urg) == 0 drop # NULL scan
tcp flags & (fin|psh|urg) == (fin|psh|urg) drop # XMAS scan
tcp flags & (fin|syn) == (fin|syn) drop # SYN-ACK scan
tcp flags & (syn|rst|fin) == (syn|rst|fin) drop # Xmas scan
tcp flags & (syn|fin|rst|psh|ack) == (syn|rst|fin|ack) drop # Xmas scan

# == 🚫 Blocking fragmented packets — commonly used in filter evasion ==
ip frag-off & 0x1fff != 0 drop

# == 🔒 Blocking spoofed IP packets ==
ip saddr 127.0.0.0/8 drop # localhost
ip saddr 10.0.0.0/8 drop # private network
ip saddr 172.16.0.0/12 drop # private network
ip saddr 192.168.0.0/16 drop # private network
ip saddr 169.254.0.0/16 drop # APIPA
ip saddr 0.0.0.0/8 drop # invalid address
ip saddr 224.0.0.0/4 drop # multicast
ip saddr 240.0.0.0/5 drop # reserved
}

# = Main chain policy =
chain forward {
type filter hook forward priority 0;
policy accept;

# = Blocking various types of attacks =
# Required in chain forward only if Docker or Oracle VirtualBox is present.
# If needed — uncomment.

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
# ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
# ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
# ip protocol icmp icmp type echo-request limit rate 1/second accept
# ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
# ip protocol icmp icmp type echo-request drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports required for application operation ==
tcp dport {
53, # DNS — needed for domain name resolution
80, # HTTP — web traffic, updates and resource loading
443, # HTTPS — secure web traffic, VPN, browser
12043, # Custom 3D Application — specific client port
13000-13050 # Custom 3D Application — dynamic client port range
} accept

# == Allow UDP ports required for application operation ==
udp dport {
53, # DNS — needed for domain name resolution
443, # HTTPS via QUIC/HTTP3, browser protocols
3478, # STUN/TURN — WebRTC and video calls
3479-3481 # STUN/TURN — WebRTC and video calls
} accept

# = Blocking dangerous and unnecessary TCP/UDP ports and ranges =

# These blocklists are intended for a DESKTOP / workstation.
# They block remote access, outdated services, proxies, DBs, IoT, and ports
# often used by malware, scanners, and C2 infrastructures.
#
# ⚠ If you use the system as a SERVER, enable IP forwarding,
# or run services with internal routing
# (Docker NAT/bridge, VirtualBox host-only/bridged, VPN clients),
# carefully review the blocked ports/ranges in the forward chain —
# these services may need extra ports.
# Adjust or comment out required items if necessary.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high risk) ===
22, # SSH — common brute-force target
23, # Telnet — outdated, no encryption
3389, # RDP — Windows remote desktop
5900, # VNC — remote access, frequent vulnerabilities
# === FTP / SMB / NetBIOS (unsafe file-sharing protocols) ===
21, # FTP — insecure protocol
137, # NetBIOS Name Service
138, # NetBIOS Datagram
139, # NetBIOS Session
445, # SMB/CIFS — common exploit target
# === Databases (NEVER expose to the Internet) ===
3306, # MySQL/MariaDB
1433, # MS SQL Server
1434, # MS SQL Browser
# === HTTP-alt/Proxy/Elasticsearch (exploited frequently) ===
8080, # HTTP proxy / web interfaces — often exposed accidentally
9200, # Elasticsearch API — full remote data access
# === UPnP/IoT (insecure by design) ===
1900, # SSDP / UPnP
# === Common for malware (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell
5555, # Android ADB / IoT botnets
9001, # Tor transport (used by malware)
1234, # Netcat / reverse connections
1337, # Common C2 port used by malware
# === ⚠️ Scanner ports and potentially vulnerable services ===
1080, # SOCKS proxy — used to bypass filtering
3128, # Squid proxy — may be abused as open proxy
8000, # Alternative HTTP ports, dev servers
8888, # Web interfaces, proxies, dev tools
10000 # Webmin — remote admin panel, frequent attacks
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; abused by attackers
162 # SNMP Trap — also potentially vulnerable
} drop

# Attention! Blocking wide port ranges — be careful!
# Do not break system or application functionality!

# == TCP port ranges not used by a workstation during transit routing ==
# Blocked to prevent unwanted forwarding, hidden tunnels,
# NAT evasion, parasitic flows, and potential forward-path attacks.

tcp dport {
1024-2047, # System/legacy services; rarely needed in forward
2048-4095, # Proprietary daemons; NFS (2049) — check if used
4096-8191, # Old VPNs, some games, P2P; rarely needed on desktop
8192-12287, # Alternative HTTP/proxy, multimedia; test as needed
12288-16383, # Media/VoIP (TCP fallback); may break calls
16384-24575, # RTP/WebRTC (TCP fallback); block unless AV needed
24576-32767, # Dynamic ranges for games/VPN; may cause issues
32768-49151, # Registered/ephemeral; risky — may break NAT, Docker, VM
49152-65535 # High ephemeral; widely used by modern apps
} drop

# == 🚫 Blocking UDP ports — high and dynamic ranges ==
udp dport {
1024-9999, # low/mid ephemeral ports; used by trojans, P2P, games, VPN
10000-65535 # high ephemeral; used by dynamic apps, VPN, Docker
} drop

# = 🕷️ Suspicious IPs — large ranges often used by botnets, spam nets, and scanners =
ip saddr {
185.0.0.0/8, # abused hosting and proxy networks
37.0.0.0/8, # cheap VPS, frequent scanning sources
88.0.0.0/8, # common brute-force and scanner range
77.0.0.0/8, # TOR/proxy nodes
91.0.0.0/8 # botnets and “grey-zone” hosting
} drop
}

chain output {
# = Main chain policy =
type filter hook output priority 0;
policy accept;

# = Blocking various types of attacks =

# == 🔒 Limiting new connections from a single IP (anti-DDoS) ==
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# = ICMP protocol restrictions =

# == 🛡️ Ping limitation ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == Critically important ICMP for network ==
ip protocol icmp icmp type { destination-unreachable, time-exceeded, parameter-problem } accept

# == Important ICMPv6 for IPv6 ==
ip6 nexthdr icmpv6 icmpv6 type { 1, 2, 3, 4 } accept
ip6 nexthdr icmpv6 icmpv6 type { 135, 136 } accept # NS/NA
ip6 nexthdr icmpv6 icmpv6 type { 133, 134 } accept # RS/RA

# == Drop all other ICMP and ICMPv6 ==
ip protocol icmp drop # drop all other ICMP
ip6 nexthdr icmpv6 drop # drop all other ICMPv6

# = SCTP protocol blocking =
# 99.9% of desktop systems do not use SCTP at all
meta l4proto sctp drop

# = DCCP — Datagram Congestion Control Protocol blocking =
# Not used by any mainstream desktop applications
meta l4proto dccp drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports and ranges required for application functionality ==
tcp dport {
53, # DNS client. Required for Internet to work: domain name resolution (UDP/TCP).
80, # HTTP traffic to unencrypted websites; apps may use it for API/redirects.
443, # HTTPS. Main port for all encrypted web traffic — browsers, API, VPN, updates.
3306, # MySQL client. Needed if you connect to MySQL.
3478, # STUN/TURN WebRTC. Needed for audio/video/Discord.
3000, # Node.js dev servers. Needed for development.
3690, # SVN. If you work with an old repository.
4443, # Alternative HTTPS (some APIs). Also used by some VPN/clients.
12043, # Required for Custom 3D Application.
13000-13050 # Required for Custom 3D Application.
} accept

# == Allow UDP ports and ranges required for applications ==
udp dport {
443, # Required for fast and stable operation of modern websites
# (Google, YouTube, ChatGPT, Cloudflare)
13000-13050 # Required for Custom 3D Application.
} accept

# = Blocking potentially dangerous / unnecessary TCP/UDP ports =

# These blocks are intended for a DESKTOP / workstation.
# ⚠ If you use the system as a SERVER —
# adjust or comment out the required ports/ranges as needed.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high-risk) ===
22, # SSH — target of brute-force attacks.
23, # Telnet — outdated, unencrypted.
3389, # RDP — Windows remote access.
5900, # VNC — remote access, often vulnerable.
# === FTP / SMB / NetBIOS (dangerous file-sharing services) ===
21, # FTP — insecure protocol.
137, # NetBIOS Name Service.
138, # NetBIOS Datagram.
139, # NetBIOS Session.
445, # SMB/CIFS — frequent exploitation target.
# === Databases (NEVER open to the Internet) ===
3306, # MySQL/MariaDB.
1433, # MS SQL Server.
1434, # MS SQL Browser.
# === HTTP-alt/Proxy/Elasticsearch (dangerous, often attacked) ===
8080, # HTTP proxy / web interfaces — often exposed test interfaces.
9200, # Elasticsearch API — full remote access to data.
# === UPnP/IoT (vulnerable by design) ===
1900, # SSDP / UPnP.
# === Common malware ports (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell.
5555, # Android ADB / IoT botnets.
9001, # Tor transport (used by malware).
1234, # Netcat / reverse connections.
1337, # Common C2 malware port.
# === ⚠️ Ports of scanners and potentially vulnerable services ===
1080, # SOCKS proxy — often abused for bypassing filters.
3128, # Squid HTTP proxy — can be used as open proxy.
8000, # Alternative HTTP ports, web services — potentially vulnerable.
8888, # Alternative web interfaces — test and proxy ports.
10000 # Webmin — web admin panel, target of attacks.
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; can be abused by attackers.
162 # SNMP Trap — same, potential vulnerability.
} drop

# Warning! ⚠️ Be careful blocking wide port ranges! ⚠️
# Do not break system or application functionality!
# If you need a range — uncomment.
# If you don’t — comment out.

# == Blocking “dangerous” and desktop-unnecessary TCP port ranges ==
tcp dport {
1-1023, # 🛑 Privileged ports.
1024-2047, # r-commands (rlogin, rsh, rexec), old RPC, NFS, legacy daemons.
2048-3071, # Rare proprietary protocols and middleware.
3072-4999, # Mostly ports of legacy, server, corporate apps;
# rarely needed on workstations.
5000-5999, # Alternative services, old P2P/admin ports, rarely used on desktops.
7000-7999, # Alternative/test ports, often used by trojans.
9000-9999, # Web services, proxies, possible backdoor ports.
10000-19998, # Dynamic/high service ports; may be required by some apps like Custom 3D Application,
# but not needed by most desktop services.
19999-32767 # Old ephemeral port range; used by P2P, games, some VPNs,
# but system services rarely use them.
} drop

# == Blocking “dangerous” and desktop-unnecessary UDP port ranges ==
udp dport {
1024-2047, # Old UNIX services, RPC, NFS, r-commands, legacy daemons.
# Usually safe to block.
2048-4095, # Rarely used standard ports, proprietary services.
# Usually safe to block.
4096-8191, # VPN, games, P2P, WebRTC, VoIP of some clients.
# Can block, but cautiously: may affect VPN/apps.
8192-12287, # QUIC/HTTP3, proxies, multimedia protocols.
# Might cause side effects; better test first.
12288-16383, # Old RTP/VoIP ranges and media streams.
# Can block, but might break video calls.
16384-24575, # Main RTP range (audio/video), WebRTC, VoIP.
# ❗ Do not block if you need video calls/WebRTC/VPN.
24576-32767 # Dynamic ports for VPN, P2P, games, streaming data.
# ❗ May break VPN or some apps.
} drop

# == 🕷️ Blocking suspicious IPs —
# large ranges often used by botnets, spam networks, and scanners ==
ip saddr {
185.0.0.0/8, # Abused hosting and proxy networks.
37.0.0.0/8, # Cheap VPS, scanning sources.
88.0.0.0/8, # Frequent brute-force and scanners.
77.0.0.0/8, # Massive TOR/proxy nodes.
91.0.0.0/8 # Botnets and “grey” hosting.
} drop
}
}

</syntaxhighlight>

====== sysctl config: ======
kernel parameters configuration

/etc/sysctl.d/99-protect.conf<syntaxhighlight lang="bash">
# 1 Ignore ICMP on interfaces
net.ipv4.icmp_echo_ignore_all = 1

# 2 Do not respond to ICMP broadcast (against Smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 3 Enable SYN backlog reduction
net.ipv4.tcp_syncookies = 1

# 4 Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 5 Log packets with incorrect routing
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# 6 Disable ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# 7 Disable packet forwarding
net.ipv4.ip_forward = 0

# 8 Disable IPv6 support
net.ipv4.conf.all.disable_ipv6 = 1
net.ipv4.conf.default.disable_ipv6 = 1

# 9 Prevent sending TCP segments with null windows
net.ipv4.tcp_rfc1337 = 1

# 10 Disable ARP filtering for automatic routing
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1

# 11 Limit the maximum size of the incoming TCP window
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# 12 Drop packets with incorrect checksums
net.ipv4.conf.all.drop_unicast_in_l2_multicast = 1
net.ipv4.conf.default.drop_unicast_in_l2_multicast = 1

# 13 Disable IPv6 forwarding
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# 14 Limit the maximum number of SYN packet retries
net.ipv4.tcp_synack_retries = 2

# 15 Increase routing cache lifetime
net.ipv4.route.max_size = 32768
</syntaxhighlight>

====== auditd rules config: ======
/etc/audit/rules.d/audit.rules

<syntaxhighlight lang="bash">
## Flush rules
-D

## Buffers
-b 8192
--backlog_wait_time 60000
-f 1

## Network audit
-a always,exit -F arch=b64 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b64 -S accept4 -F success=1 -k network_accept
-a always,exit -F arch=b32 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b32 -S accept4 -F success=1 -k network_accept

## Logging execve commands
-a always,exit -F arch=b64 -S execve -F key=exec_log

## Audit logins and sessions
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session

## sudo / su
-w /etc/sudoers -p wa -k sudo
-w /etc/sudoers.d/ -p wa -k sudo
-w /bin/su -p x -k su_cmd

## Account and configuration changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/hosts -p wa -k system_conf
-w /etc/hostname -p wa -k system_conf
-w /etc/resolv.conf -p wa -k system_conf
-w /etc/issue -p wa -k system_conf
-w /etc/network/ -p wa -k system_conf

## Time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -F key=time_change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -F key=time_change

## Audit SSH connections and changes
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /var/log/auth.log -p wa -k ssh_login

## Audit usage of remote tools (e.g., SSH, netcat)
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/nc -k nc_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/nc -k nc_process

## Audit privileged access
-a always,exit -F arch=b64 -S setuid -S setgid -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -S setgid -k privilege_escalation
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/sudoers.d/ -p wa -k sudoers_changes
-w /bin/sudo -p x -k sudo_command

## Monitor credential changes
#-w /root/.ssh/ -p wa -k ssh_keys
#-w /home/*/.ssh/ -p wa -k ssh_keys

## Audit use of remote network services
-a always,exit -F arch=b64 -S socket -F success=1 -k socket_connect
-a always,exit -F arch=b32 -S socket -F success=1 -k socket_connect

# Log package installation and removal via dpkg
-w /usr/bin/dpkg -p x
-w /usr/sbin/apt-get -p x
-w /usr/bin/apt -p x
</syntaxhighlight>

==== UsefulPrograms ====

Here is the list of programs useful for configuring and maintaining the security of Linux systems. The included programs are either open-source (the majority) or commercial, but with freely available limited features sufficient to address core security tasks (a smaller portion).

https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/UsefulPrograms

==== External Resources ====

[https://www.debian.org/doc/manuals/securing-debian-manual/index.en.html|Securing Debian Manual 3.19 — Javier Fernández-Sanguino Peña.]
This document describes security in the Debian project and in the Debian operating system. Starting with the process of securing and hardening the default Debian GNU/Linux distribution installation, it also covers some of the common tasks to set up a secure network environment using Debian GNU/Linux, gives additional information on the security tools available and talks about how security is enforced in Debian by the security and audit team.

[https://medium.com/%40ihouelecaurcy/the-complete-nftables-guide-modern-linux-firewall-mastery-79fb86894d5c|The Complete nftables Guide: Modern Linux Firewall Mastery — Ihouele Caurcy]
The definitive guide to nftables — the modern replacement for iptables, ip6tables, arptables, and ebtables. From basic concepts to enterprise-level configurations.

[https://notes.suhaib.in/docs/tech/utilities/iptables-nftables-and-you-a-friendly-guide-to-traffic-rules/|iptables, nftables, and You A Friendly Guide to Traffic Rules]
A friendly guide to iptables and nftables in Linux: explains Netfilter architecture, tables, chains and rules, with configuration examples (SSH, IP blocking, port forwarding). Covers differences between iptables and nftables, migration, and compatibility with modern firewall tools. Useful for understanding the iptables→nftables transition and practical examples.

[https://public.jdstone1.com/books_and_magazines/Computer_Books/Operating_Systems/SELinux%20System%20Administration%20(3rd%20ed).pdf|SELinux System Administration Third Edition — Sven Vermeulen.]
Implement mandatory access control to secure applications, users, and information flows on Linux.

[https://gitlab.com/apparmor/apparmor/-/wikis/home AppArmor]
The official wiki for the AppArmor security project on Linux. Provides guidance for users and developers, instructions for creating and managing security profiles, example access policies for applications, and best practices to protect the operating system.

[https://nallino.net/stockage/security/Linux_Mint_Security.pdf|Security, Privacy and Anonymity in Linux Mint — Michel Nallino.]
A good and comprehensive work on Linux Mint security that can also be useful for other Linux distributions.

[https://www.cisa.gov/topics/cybersecurity-best-practices|CISA — Cybersecurity Best Practices]
CISA (Certified Information Systems Auditor) provides information on cybersecurity best practices to help individuals and organizations implement preventative measures and manage cyber risks.

==== Provenance ====

This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131

it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks

[[index.php?title=Category:Security]]
[[index.php?title=Category:Hardening]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2025-12-18T18:56:16Z

Blackcat568: /* Related Aspects of Internet Security */

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.
* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

''Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build).''

Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

====== Main Aspects of System Hardening ======

# Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.
# If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to type long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>
# Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.
# Avoid using the superuser account or sudo without a clear necessity — and never execute arbitrary scripts with sudo. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
## Always read a script fully before running it (less script.sh, cat script.sh).
## Never paste commands from untrusted or unverified sources into the terminal.
## Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
## Follow the principle of least privilege — create separate user accounts and limit access rights where possible <blockquote>'''Important:''' Improper or careless use of sudo and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.</blockquote>
# Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. You may also consider switching to SELinux. If you have difficulty configuring AppArmor or SELinux, seek help from specialists or use AI-based tools. My SELinux configuration is attached below (I use SELinux on Debian 12 — it works reliably).
# Use advanced network filtering settings: iptables or nftables, or a commercial firewall. (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#nftables config:|nftables config]]
# Configure kernel parameters for maximum security (sysctl hardening). (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#sysctl config:|sysctl config]])
# Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event). (sample [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#auditd rules config:|auditd rules config]]
# Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.
# If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.
# Follow the principle of Attack Surface Reduction (or [https://en.wikipedia.org/wiki/Occam's_razor Occam's Razor]) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
## If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
## If you are certain you will never use it, remove it completely from the system.
## This practice reduces potential attack vectors and strengthens overall system security.
## Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications.
## Always create a full system backup before making any significant configuration changes or modifications.
# Perform regular antivirus and anti-rootkit scans of the system. In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.
# Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:
<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

====== Related Aspects of Internet Security ======

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

# Store passwords in a reliable password manager. '''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:

* relying on human memory, with the risk of forgetting or confusing credentials;
* storing passwords on paper media, which can be damaged, lost, or stolen;
* saving passwords in web browsers in unencrypted form;
* keeping passwords in plain text files on the desktop or in other directories without encryption;
* and similar approaches.
Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.

A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.

Regularly create up-to-date backups of the ''encrypted'' password database.

Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.

Additional Practical Recommendations

A password manager (for example, [[https://keepassxc.org/%7CKeePassXC]]) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.

In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.

It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).

#

===== Examples of Deep Custom Security Configurations =====

Below are examples of strong, individualized configurations for '''SELinux''', '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

====== SELinux config: ======
<syntaxhighlight lang="terminfo">
root@user:/home/user# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
root@user:/home/user# sestatus -v
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

Process contexts:
Current context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Init context: system_u:system_r:init_t:s0
/sbin/agetty system_u:system_r:getty_t:s0

File contexts:
Controlling terminal: unconfined_u:object_r:user_devpts_t:s0
/etc/passwd system_u:object_r:etc_t:s0
/etc/shadow system_u:object_r:unlabeled_t:s0
/bin/bash system_u:object_r:shell_exec_t:s0
/bin/login system_u:object_r:login_exec_t:s0
/bin/sh system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0
/sbin/agetty system_u:object_r:getty_exec_t:s0
/sbin/init system_u:object_r:bin_t:s0 -> system_u:object_r:init_exec_t:s0
/lib/ld-linux.so.2 system_u:object_r:lib_t:s0 -> system_u:object_r:ld_so_t:s0
</syntaxhighlight>

====== nftables config: ======
<syntaxhighlight lang="bash">
#!/usr/sbin/nft -f

flush ruleset

table inet filter {

# = Main chain policy =
chain input {
type filter hook input priority 0;
policy drop;

# = Common rule set =
# 🌀 Allow loopback interface (internal system processes)
iif "lo" accept

# == 🔁 Allow established and related connections ==
ct state established,related accept

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# == 🔒 Limit the rate of NEW connections per source IP (basic anti-DDoS protection) ==
# If you experience issues with slow or failed page loads in your browser,
# try increasing the limit, for example:
# ip saddr 0.0.0.0/0 ct state new limit rate 50/second burst 100 packets accept
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == 🚫 Blocking SSDP and mDNS (local broadcast discovery protocols) ==
ip daddr 239.255.255.250 udp dport 1900 drop # ❌ SSDP (UPnP/device discovery)
ip daddr 224.0.0.251 udp dport 5353 drop # ❌ mDNS (Bonjour, Avahi)

# == 🛑 Blocking NetBIOS and LLMNR (Windows/systemd internal LAN protocols) ==
udp dport 137 drop # ❌ NetBIOS Name Service (Windows network names)
udp dport 138 drop # ❌ NetBIOS Datagram Service (LAN name discovery)
udp dport 5355 drop # ❌ LLMNR (Link-Local Multicast Name Resolution)

# = Set of blocked IP addresses and ranges =

# == 🧱 Blocking known botnets and proxy networks ==
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} log prefix "🔥 BAN: known bots " flags all
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} drop

# == 🚫 Blocking strange TCP flags (XMAS, NULL scans and others) ==
tcp flags & (fin|syn|rst|psh|ack|urg) == 0 drop # NULL scan
tcp flags & (fin|psh|urg) == (fin|psh|urg) drop # XMAS scan
tcp flags & (fin|syn) == (fin|syn) drop # SYN-ACK scan
tcp flags & (syn|rst|fin) == (syn|rst|fin) drop # Xmas scan
tcp flags & (syn|fin|rst|psh|ack) == (syn|rst|fin|ack) drop # Xmas scan

# == 🚫 Blocking fragmented packets — commonly used in filter evasion ==
ip frag-off & 0x1fff != 0 drop

# == 🔒 Blocking spoofed IP packets ==
ip saddr 127.0.0.0/8 drop # localhost
ip saddr 10.0.0.0/8 drop # private network
ip saddr 172.16.0.0/12 drop # private network
ip saddr 192.168.0.0/16 drop # private network
ip saddr 169.254.0.0/16 drop # APIPA
ip saddr 0.0.0.0/8 drop # invalid address
ip saddr 224.0.0.0/4 drop # multicast
ip saddr 240.0.0.0/5 drop # reserved
}

# = Main chain policy =
chain forward {
type filter hook forward priority 0;
policy accept;

# = Blocking various types of attacks =
# Required in chain forward only if Docker or Oracle VirtualBox is present.
# If needed — uncomment.

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
# ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
# ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
# ip protocol icmp icmp type echo-request limit rate 1/second accept
# ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
# ip protocol icmp icmp type echo-request drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports required for application operation ==
tcp dport {
53, # DNS — needed for domain name resolution
80, # HTTP — web traffic, updates and resource loading
443, # HTTPS — secure web traffic, VPN, browser
12043, # Custom 3D Application — specific client port
13000-13050 # Custom 3D Application — dynamic client port range
} accept

# == Allow UDP ports required for application operation ==
udp dport {
53, # DNS — needed for domain name resolution
443, # HTTPS via QUIC/HTTP3, browser protocols
3478, # STUN/TURN — WebRTC and video calls
3479-3481 # STUN/TURN — WebRTC and video calls
} accept

# = Blocking dangerous and unnecessary TCP/UDP ports and ranges =

# These blocklists are intended for a DESKTOP / workstation.
# They block remote access, outdated services, proxies, DBs, IoT, and ports
# often used by malware, scanners, and C2 infrastructures.
#
# ⚠ If you use the system as a SERVER, enable IP forwarding,
# or run services with internal routing
# (Docker NAT/bridge, VirtualBox host-only/bridged, VPN clients),
# carefully review the blocked ports/ranges in the forward chain —
# these services may need extra ports.
# Adjust or comment out required items if necessary.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high risk) ===
22, # SSH — common brute-force target
23, # Telnet — outdated, no encryption
3389, # RDP — Windows remote desktop
5900, # VNC — remote access, frequent vulnerabilities
# === FTP / SMB / NetBIOS (unsafe file-sharing protocols) ===
21, # FTP — insecure protocol
137, # NetBIOS Name Service
138, # NetBIOS Datagram
139, # NetBIOS Session
445, # SMB/CIFS — common exploit target
# === Databases (NEVER expose to the Internet) ===
3306, # MySQL/MariaDB
1433, # MS SQL Server
1434, # MS SQL Browser
# === HTTP-alt/Proxy/Elasticsearch (exploited frequently) ===
8080, # HTTP proxy / web interfaces — often exposed accidentally
9200, # Elasticsearch API — full remote data access
# === UPnP/IoT (insecure by design) ===
1900, # SSDP / UPnP
# === Common for malware (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell
5555, # Android ADB / IoT botnets
9001, # Tor transport (used by malware)
1234, # Netcat / reverse connections
1337, # Common C2 port used by malware
# === ⚠️ Scanner ports and potentially vulnerable services ===
1080, # SOCKS proxy — used to bypass filtering
3128, # Squid proxy — may be abused as open proxy
8000, # Alternative HTTP ports, dev servers
8888, # Web interfaces, proxies, dev tools
10000 # Webmin — remote admin panel, frequent attacks
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; abused by attackers
162 # SNMP Trap — also potentially vulnerable
} drop

# Attention! Blocking wide port ranges — be careful!
# Do not break system or application functionality!

# == TCP port ranges not used by a workstation during transit routing ==
# Blocked to prevent unwanted forwarding, hidden tunnels,
# NAT evasion, parasitic flows, and potential forward-path attacks.

tcp dport {
1024-2047, # System/legacy services; rarely needed in forward
2048-4095, # Proprietary daemons; NFS (2049) — check if used
4096-8191, # Old VPNs, some games, P2P; rarely needed on desktop
8192-12287, # Alternative HTTP/proxy, multimedia; test as needed
12288-16383, # Media/VoIP (TCP fallback); may break calls
16384-24575, # RTP/WebRTC (TCP fallback); block unless AV needed
24576-32767, # Dynamic ranges for games/VPN; may cause issues
32768-49151, # Registered/ephemeral; risky — may break NAT, Docker, VM
49152-65535 # High ephemeral; widely used by modern apps
} drop

# == 🚫 Blocking UDP ports — high and dynamic ranges ==
udp dport {
1024-9999, # low/mid ephemeral ports; used by trojans, P2P, games, VPN
10000-65535 # high ephemeral; used by dynamic apps, VPN, Docker
} drop

# = 🕷️ Suspicious IPs — large ranges often used by botnets, spam nets, and scanners =
ip saddr {
185.0.0.0/8, # abused hosting and proxy networks
37.0.0.0/8, # cheap VPS, frequent scanning sources
88.0.0.0/8, # common brute-force and scanner range
77.0.0.0/8, # TOR/proxy nodes
91.0.0.0/8 # botnets and “grey-zone” hosting
} drop
}

chain output {
# = Main chain policy =
type filter hook output priority 0;
policy accept;

# = Blocking various types of attacks =

# == 🔒 Limiting new connections from a single IP (anti-DDoS) ==
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# = ICMP protocol restrictions =

# == 🛡️ Ping limitation ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == Critically important ICMP for network ==
ip protocol icmp icmp type { destination-unreachable, time-exceeded, parameter-problem } accept

# == Important ICMPv6 for IPv6 ==
ip6 nexthdr icmpv6 icmpv6 type { 1, 2, 3, 4 } accept
ip6 nexthdr icmpv6 icmpv6 type { 135, 136 } accept # NS/NA
ip6 nexthdr icmpv6 icmpv6 type { 133, 134 } accept # RS/RA

# == Drop all other ICMP and ICMPv6 ==
ip protocol icmp drop # drop all other ICMP
ip6 nexthdr icmpv6 drop # drop all other ICMPv6

# = SCTP protocol blocking =
# 99.9% of desktop systems do not use SCTP at all
meta l4proto sctp drop

# = DCCP — Datagram Congestion Control Protocol blocking =
# Not used by any mainstream desktop applications
meta l4proto dccp drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports and ranges required for application functionality ==
tcp dport {
53, # DNS client. Required for Internet to work: domain name resolution (UDP/TCP).
80, # HTTP traffic to unencrypted websites; apps may use it for API/redirects.
443, # HTTPS. Main port for all encrypted web traffic — browsers, API, VPN, updates.
3306, # MySQL client. Needed if you connect to MySQL.
3478, # STUN/TURN WebRTC. Needed for audio/video/Discord.
3000, # Node.js dev servers. Needed for development.
3690, # SVN. If you work with an old repository.
4443, # Alternative HTTPS (some APIs). Also used by some VPN/clients.
12043, # Required for Custom 3D Application.
13000-13050 # Required for Custom 3D Application.
} accept

# == Allow UDP ports and ranges required for applications ==
udp dport {
443, # Required for fast and stable operation of modern websites
# (Google, YouTube, ChatGPT, Cloudflare)
13000-13050 # Required for Custom 3D Application.
} accept

# = Blocking potentially dangerous / unnecessary TCP/UDP ports =

# These blocks are intended for a DESKTOP / workstation.
# ⚠ If you use the system as a SERVER —
# adjust or comment out the required ports/ranges as needed.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high-risk) ===
22, # SSH — target of brute-force attacks.
23, # Telnet — outdated, unencrypted.
3389, # RDP — Windows remote access.
5900, # VNC — remote access, often vulnerable.
# === FTP / SMB / NetBIOS (dangerous file-sharing services) ===
21, # FTP — insecure protocol.
137, # NetBIOS Name Service.
138, # NetBIOS Datagram.
139, # NetBIOS Session.
445, # SMB/CIFS — frequent exploitation target.
# === Databases (NEVER open to the Internet) ===
3306, # MySQL/MariaDB.
1433, # MS SQL Server.
1434, # MS SQL Browser.
# === HTTP-alt/Proxy/Elasticsearch (dangerous, often attacked) ===
8080, # HTTP proxy / web interfaces — often exposed test interfaces.
9200, # Elasticsearch API — full remote access to data.
# === UPnP/IoT (vulnerable by design) ===
1900, # SSDP / UPnP.
# === Common malware ports (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell.
5555, # Android ADB / IoT botnets.
9001, # Tor transport (used by malware).
1234, # Netcat / reverse connections.
1337, # Common C2 malware port.
# === ⚠️ Ports of scanners and potentially vulnerable services ===
1080, # SOCKS proxy — often abused for bypassing filters.
3128, # Squid HTTP proxy — can be used as open proxy.
8000, # Alternative HTTP ports, web services — potentially vulnerable.
8888, # Alternative web interfaces — test and proxy ports.
10000 # Webmin — web admin panel, target of attacks.
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; can be abused by attackers.
162 # SNMP Trap — same, potential vulnerability.
} drop

# Warning! ⚠️ Be careful blocking wide port ranges! ⚠️
# Do not break system or application functionality!
# If you need a range — uncomment.
# If you don’t — comment out.

# == Blocking “dangerous” and desktop-unnecessary TCP port ranges ==
tcp dport {
1-1023, # 🛑 Privileged ports.
1024-2047, # r-commands (rlogin, rsh, rexec), old RPC, NFS, legacy daemons.
2048-3071, # Rare proprietary protocols and middleware.
3072-4999, # Mostly ports of legacy, server, corporate apps;
# rarely needed on workstations.
5000-5999, # Alternative services, old P2P/admin ports, rarely used on desktops.
7000-7999, # Alternative/test ports, often used by trojans.
9000-9999, # Web services, proxies, possible backdoor ports.
10000-19998, # Dynamic/high service ports; may be required by some apps like Custom 3D Application,
# but not needed by most desktop services.
19999-32767 # Old ephemeral port range; used by P2P, games, some VPNs,
# but system services rarely use them.
} drop

# == Blocking “dangerous” and desktop-unnecessary UDP port ranges ==
udp dport {
1024-2047, # Old UNIX services, RPC, NFS, r-commands, legacy daemons.
# Usually safe to block.
2048-4095, # Rarely used standard ports, proprietary services.
# Usually safe to block.
4096-8191, # VPN, games, P2P, WebRTC, VoIP of some clients.
# Can block, but cautiously: may affect VPN/apps.
8192-12287, # QUIC/HTTP3, proxies, multimedia protocols.
# Might cause side effects; better test first.
12288-16383, # Old RTP/VoIP ranges and media streams.
# Can block, but might break video calls.
16384-24575, # Main RTP range (audio/video), WebRTC, VoIP.
# ❗ Do not block if you need video calls/WebRTC/VPN.
24576-32767 # Dynamic ports for VPN, P2P, games, streaming data.
# ❗ May break VPN or some apps.
} drop

# == 🕷️ Blocking suspicious IPs —
# large ranges often used by botnets, spam networks, and scanners ==
ip saddr {
185.0.0.0/8, # Abused hosting and proxy networks.
37.0.0.0/8, # Cheap VPS, scanning sources.
88.0.0.0/8, # Frequent brute-force and scanners.
77.0.0.0/8, # Massive TOR/proxy nodes.
91.0.0.0/8 # Botnets and “grey” hosting.
} drop
}
}

</syntaxhighlight>

====== sysctl config: ======
kernel parameters configuration

/etc/sysctl.d/99-protect.conf<syntaxhighlight lang="bash">
# 1 Ignore ICMP on interfaces
net.ipv4.icmp_echo_ignore_all = 1

# 2 Do not respond to ICMP broadcast (against Smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 3 Enable SYN backlog reduction
net.ipv4.tcp_syncookies = 1

# 4 Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 5 Log packets with incorrect routing
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# 6 Disable ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# 7 Disable packet forwarding
net.ipv4.ip_forward = 0

# 8 Disable IPv6 support
net.ipv4.conf.all.disable_ipv6 = 1
net.ipv4.conf.default.disable_ipv6 = 1

# 9 Prevent sending TCP segments with null windows
net.ipv4.tcp_rfc1337 = 1

# 10 Disable ARP filtering for automatic routing
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1

# 11 Limit the maximum size of the incoming TCP window
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# 12 Drop packets with incorrect checksums
net.ipv4.conf.all.drop_unicast_in_l2_multicast = 1
net.ipv4.conf.default.drop_unicast_in_l2_multicast = 1

# 13 Disable IPv6 forwarding
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# 14 Limit the maximum number of SYN packet retries
net.ipv4.tcp_synack_retries = 2

# 15 Increase routing cache lifetime
net.ipv4.route.max_size = 32768
</syntaxhighlight>

====== auditd rules config: ======
/etc/audit/rules.d/audit.rules

<syntaxhighlight lang="bash">
## Flush rules
-D

## Buffers
-b 8192
--backlog_wait_time 60000
-f 1

## Network audit
-a always,exit -F arch=b64 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b64 -S accept4 -F success=1 -k network_accept
-a always,exit -F arch=b32 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b32 -S accept4 -F success=1 -k network_accept

## Logging execve commands
-a always,exit -F arch=b64 -S execve -F key=exec_log

## Audit logins and sessions
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session

## sudo / su
-w /etc/sudoers -p wa -k sudo
-w /etc/sudoers.d/ -p wa -k sudo
-w /bin/su -p x -k su_cmd

## Account and configuration changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/hosts -p wa -k system_conf
-w /etc/hostname -p wa -k system_conf
-w /etc/resolv.conf -p wa -k system_conf
-w /etc/issue -p wa -k system_conf
-w /etc/network/ -p wa -k system_conf

## Time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -F key=time_change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -F key=time_change

## Audit SSH connections and changes
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /var/log/auth.log -p wa -k ssh_login

## Audit usage of remote tools (e.g., SSH, netcat)
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/nc -k nc_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/nc -k nc_process

## Audit privileged access
-a always,exit -F arch=b64 -S setuid -S setgid -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -S setgid -k privilege_escalation
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/sudoers.d/ -p wa -k sudoers_changes
-w /bin/sudo -p x -k sudo_command

## Monitor credential changes
#-w /root/.ssh/ -p wa -k ssh_keys
#-w /home/*/.ssh/ -p wa -k ssh_keys

## Audit use of remote network services
-a always,exit -F arch=b64 -S socket -F success=1 -k socket_connect
-a always,exit -F arch=b32 -S socket -F success=1 -k socket_connect

# Log package installation and removal via dpkg
-w /usr/bin/dpkg -p x
-w /usr/sbin/apt-get -p x
-w /usr/bin/apt -p x
</syntaxhighlight>

==== UsefulPrograms ====

Here is the list of programs useful for configuring and maintaining the security of Linux systems. The included programs are either open-source (the majority) or commercial, but with freely available limited features sufficient to address core security tasks (a smaller portion).

https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/UsefulPrograms

==== External Resources ====

[https://www.debian.org/doc/manuals/securing-debian-manual/index.en.html|Securing Debian Manual 3.19 — Javier Fernández-Sanguino Peña.]
This document describes security in the Debian project and in the Debian operating system. Starting with the process of securing and hardening the default Debian GNU/Linux distribution installation, it also covers some of the common tasks to set up a secure network environment using Debian GNU/Linux, gives additional information on the security tools available and talks about how security is enforced in Debian by the security and audit team.

[https://medium.com/%40ihouelecaurcy/the-complete-nftables-guide-modern-linux-firewall-mastery-79fb86894d5c|The Complete nftables Guide: Modern Linux Firewall Mastery — Ihouele Caurcy]
The definitive guide to nftables — the modern replacement for iptables, ip6tables, arptables, and ebtables. From basic concepts to enterprise-level configurations.

[https://notes.suhaib.in/docs/tech/utilities/iptables-nftables-and-you-a-friendly-guide-to-traffic-rules/|iptables, nftables, and You A Friendly Guide to Traffic Rules]
A friendly guide to iptables and nftables in Linux: explains Netfilter architecture, tables, chains and rules, with configuration examples (SSH, IP blocking, port forwarding). Covers differences between iptables and nftables, migration, and compatibility with modern firewall tools. Useful for understanding the iptables→nftables transition and practical examples.

[https://public.jdstone1.com/books_and_magazines/Computer_Books/Operating_Systems/SELinux%20System%20Administration%20(3rd%20ed).pdf|SELinux System Administration Third Edition — Sven Vermeulen.]
Implement mandatory access control to secure applications, users, and information flows on Linux.

[https://gitlab.com/apparmor/apparmor/-/wikis/home AppArmor]
The official wiki for the AppArmor security project on Linux. Provides guidance for users and developers, instructions for creating and managing security profiles, example access policies for applications, and best practices to protect the operating system.

[https://nallino.net/stockage/security/Linux_Mint_Security.pdf|Security, Privacy and Anonymity in Linux Mint — Michel Nallino.]
A good and comprehensive work on Linux Mint security that can also be useful for other Linux distributions.

[https://www.cisa.gov/topics/cybersecurity-best-practices|CISA — Cybersecurity Best Practices]
CISA (Certified Information Systems Auditor) provides information on cybersecurity best practices to help individuals and organizations implement preventative measures and manage cyber risks.

==== Provenance ====

This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131

it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks

[[index.php?title=Category:Security]]
[[index.php?title=Category:Hardening]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2025-12-18T18:50:30Z

Blackcat568:

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.
* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

''Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build).''

Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

====== Main Aspects of System Hardening ======

# Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.
# If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to type long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>
# Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.
# Avoid using the superuser account or sudo without a clear necessity — and never execute arbitrary scripts with sudo. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
## Always read a script fully before running it (less script.sh, cat script.sh).
## Never paste commands from untrusted or unverified sources into the terminal.
## Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
## Follow the principle of least privilege — create separate user accounts and limit access rights where possible <blockquote>'''Important:''' Improper or careless use of sudo and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.</blockquote>
# Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. You may also consider switching to SELinux. If you have difficulty configuring AppArmor or SELinux, seek help from specialists or use AI-based tools. My SELinux configuration is attached below (I use SELinux on Debian 12 — it works reliably).
# Use advanced network filtering settings: iptables or nftables, or a commercial firewall. (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#nftables config:|nftables config]]
# Configure kernel parameters for maximum security (sysctl hardening). (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#sysctl config:|sysctl config]])
# Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event). (sample [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#auditd rules config:|auditd rules config]]
# Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.
# If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.
# Follow the principle of Attack Surface Reduction (or [https://en.wikipedia.org/wiki/Occam's_razor Occam's Razor]) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
## If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
## If you are certain you will never use it, remove it completely from the system.
## This practice reduces potential attack vectors and strengthens overall system security.
## Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications.
## Always create a full system backup before making any significant configuration changes or modifications.
# Perform regular antivirus and anti-rootkit scans of the system. In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.
# Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:
<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

====== Related Aspects of Internet Security ======

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

Store passwords in a reliable password manager.
'''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:
relying on human memory, with the risk of forgetting or confusing credentials;
storing passwords on paper media, which can be damaged, lost, or stolen;
saving passwords in web browsers in unencrypted form;
keeping passwords in plain text files on the desktop or in other directories without encryption;
and similar approaches.
Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.
A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.
Regularly create up-to-date backups of the ''encrypted'' password database.
Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.
Additional Practical Recommendations:
A password manager (for example, KeePassXC) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.
In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.
It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).
Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [[wikipedia:Authenticator_app|Authenticator_app]]), or a hardware security key such as a [[wikipedia:YubiKey|YubiKey]].
This is a critical cybersecurity measure — neglecting it can completely undermine all your efforts in configuring a secure Linux system.
The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:
YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number. For now, it is one of the most reliable hardware-based options for two-factor authentication.
Using VPN to improve privacy and security
''If you are a private user'', you can also configure a system-wide VPN (for example, ProtonVPN) so that all device traffic is routed through it — not only browser traffic or traffic from specific applications.
Enable the “killswitch” mode and disable it only when necessary, re-enabling it immediately afterwards.
It is also recommended to periodically change VPN servers, doing so at different and unpredictable intervals.
Using a VPN increases your privacy: all of your traffic will be encrypted from observers on your local network and from your internet service provider. This makes it more difficult for an attacker to apply certain social-engineering methods based on traffic analysis, and it also helps protect your privacy in the event that your provider’s infrastructure is compromised.
''If you own a server'' and want access to it to be available only to trusted private or legal entities, while also increasing its protection against unauthorized access, you can configure the server so that SSH and other internal services are accessible exclusively through OpenVPN using TLS authentication (tls-auth / tls-crypt) and unique client certificates instead of passwords.
Actively study and apply artificial intelligence to improve security configurations in Debian and other Linux distributions, as well as to address related cybersecurity tasks. A lack of knowledge often becomes the weakest link; AI can provide accurate, structured recommendations interactively and help automate repetitive or complex operations.
If privacy is a priority, consider reducing reliance on the Google ecosystem and switching to more privacy-focused alternatives (for example, proton.me and similar services). Google provides very strong security, but its services collect extensive telemetry for analysis. While this data is encrypted and not accessible to attackers, it may still be undesirable for users who value strict privacy.
<blockquote>''Always verify AI-generated recommendations before applying them in production environments. Test any changes in an isolated system, review generated commands or configurations, and ensure that suggestions align with your threat model and security architecture.''

''In practice, users who effectively leverage AI tools are significantly better prepared, and the adoption of such technologies makes malicious activity considerably more difficult for attackers.''

'''''Note:''' Artificial intelligence tools are mentioned here as optional technical aids, not as an endorsement of any specific service or vendor.''</blockquote>
It is also important to consider the possibility of hardware-level attacks.

Although such attacks are significantly less common and typically require more resources than software-based attacks, they remain a potential threat. In certain scenarios, an adversary may exploit vulnerabilities in device firmware or conduct a combined attack targeting both software and hardware layers. Examples include remote injection of malicious code into the firmware of a motherboard, router, optical modem, or other hardware components.

If, after a thorough software-level audit, a security issue remains unresolved, it is advisable <nowiki>'''</nowiki>to perform a hardware-level assessment<nowiki>'''</nowiki> as well, including verification of device firmware integrity and configuration.

<blockquote>'''And most importantly — give up the illusion of complete security. We live in conditions of a severe information war, and everyone must make efforts so that malicious actors cannot freely spy on desktops and servers.'''</blockquote>

===== Examples of Deep Custom Security Configurations =====

Below are examples of strong, individualized configurations for '''SELinux''', '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

====== SELinux config: ======
<syntaxhighlight lang="terminfo">
root@user:/home/user# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
root@user:/home/user# sestatus -v
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

Process contexts:
Current context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Init context: system_u:system_r:init_t:s0
/sbin/agetty system_u:system_r:getty_t:s0

File contexts:
Controlling terminal: unconfined_u:object_r:user_devpts_t:s0
/etc/passwd system_u:object_r:etc_t:s0
/etc/shadow system_u:object_r:unlabeled_t:s0
/bin/bash system_u:object_r:shell_exec_t:s0
/bin/login system_u:object_r:login_exec_t:s0
/bin/sh system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0
/sbin/agetty system_u:object_r:getty_exec_t:s0
/sbin/init system_u:object_r:bin_t:s0 -> system_u:object_r:init_exec_t:s0
/lib/ld-linux.so.2 system_u:object_r:lib_t:s0 -> system_u:object_r:ld_so_t:s0
</syntaxhighlight>

====== nftables config: ======
<syntaxhighlight lang="bash">
#!/usr/sbin/nft -f

flush ruleset

table inet filter {

# = Main chain policy =
chain input {
type filter hook input priority 0;
policy drop;

# = Common rule set =
# 🌀 Allow loopback interface (internal system processes)
iif "lo" accept

# == 🔁 Allow established and related connections ==
ct state established,related accept

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# == 🔒 Limit the rate of NEW connections per source IP (basic anti-DDoS protection) ==
# If you experience issues with slow or failed page loads in your browser,
# try increasing the limit, for example:
# ip saddr 0.0.0.0/0 ct state new limit rate 50/second burst 100 packets accept
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == 🚫 Blocking SSDP and mDNS (local broadcast discovery protocols) ==
ip daddr 239.255.255.250 udp dport 1900 drop # ❌ SSDP (UPnP/device discovery)
ip daddr 224.0.0.251 udp dport 5353 drop # ❌ mDNS (Bonjour, Avahi)

# == 🛑 Blocking NetBIOS and LLMNR (Windows/systemd internal LAN protocols) ==
udp dport 137 drop # ❌ NetBIOS Name Service (Windows network names)
udp dport 138 drop # ❌ NetBIOS Datagram Service (LAN name discovery)
udp dport 5355 drop # ❌ LLMNR (Link-Local Multicast Name Resolution)

# = Set of blocked IP addresses and ranges =

# == 🧱 Blocking known botnets and proxy networks ==
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} log prefix "🔥 BAN: known bots " flags all
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} drop

# == 🚫 Blocking strange TCP flags (XMAS, NULL scans and others) ==
tcp flags & (fin|syn|rst|psh|ack|urg) == 0 drop # NULL scan
tcp flags & (fin|psh|urg) == (fin|psh|urg) drop # XMAS scan
tcp flags & (fin|syn) == (fin|syn) drop # SYN-ACK scan
tcp flags & (syn|rst|fin) == (syn|rst|fin) drop # Xmas scan
tcp flags & (syn|fin|rst|psh|ack) == (syn|rst|fin|ack) drop # Xmas scan

# == 🚫 Blocking fragmented packets — commonly used in filter evasion ==
ip frag-off & 0x1fff != 0 drop

# == 🔒 Blocking spoofed IP packets ==
ip saddr 127.0.0.0/8 drop # localhost
ip saddr 10.0.0.0/8 drop # private network
ip saddr 172.16.0.0/12 drop # private network
ip saddr 192.168.0.0/16 drop # private network
ip saddr 169.254.0.0/16 drop # APIPA
ip saddr 0.0.0.0/8 drop # invalid address
ip saddr 224.0.0.0/4 drop # multicast
ip saddr 240.0.0.0/5 drop # reserved
}

# = Main chain policy =
chain forward {
type filter hook forward priority 0;
policy accept;

# = Blocking various types of attacks =
# Required in chain forward only if Docker or Oracle VirtualBox is present.
# If needed — uncomment.

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
# ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
# ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
# ip protocol icmp icmp type echo-request limit rate 1/second accept
# ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
# ip protocol icmp icmp type echo-request drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports required for application operation ==
tcp dport {
53, # DNS — needed for domain name resolution
80, # HTTP — web traffic, updates and resource loading
443, # HTTPS — secure web traffic, VPN, browser
12043, # Custom 3D Application — specific client port
13000-13050 # Custom 3D Application — dynamic client port range
} accept

# == Allow UDP ports required for application operation ==
udp dport {
53, # DNS — needed for domain name resolution
443, # HTTPS via QUIC/HTTP3, browser protocols
3478, # STUN/TURN — WebRTC and video calls
3479-3481 # STUN/TURN — WebRTC and video calls
} accept

# = Blocking dangerous and unnecessary TCP/UDP ports and ranges =

# These blocklists are intended for a DESKTOP / workstation.
# They block remote access, outdated services, proxies, DBs, IoT, and ports
# often used by malware, scanners, and C2 infrastructures.
#
# ⚠ If you use the system as a SERVER, enable IP forwarding,
# or run services with internal routing
# (Docker NAT/bridge, VirtualBox host-only/bridged, VPN clients),
# carefully review the blocked ports/ranges in the forward chain —
# these services may need extra ports.
# Adjust or comment out required items if necessary.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high risk) ===
22, # SSH — common brute-force target
23, # Telnet — outdated, no encryption
3389, # RDP — Windows remote desktop
5900, # VNC — remote access, frequent vulnerabilities
# === FTP / SMB / NetBIOS (unsafe file-sharing protocols) ===
21, # FTP — insecure protocol
137, # NetBIOS Name Service
138, # NetBIOS Datagram
139, # NetBIOS Session
445, # SMB/CIFS — common exploit target
# === Databases (NEVER expose to the Internet) ===
3306, # MySQL/MariaDB
1433, # MS SQL Server
1434, # MS SQL Browser
# === HTTP-alt/Proxy/Elasticsearch (exploited frequently) ===
8080, # HTTP proxy / web interfaces — often exposed accidentally
9200, # Elasticsearch API — full remote data access
# === UPnP/IoT (insecure by design) ===
1900, # SSDP / UPnP
# === Common for malware (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell
5555, # Android ADB / IoT botnets
9001, # Tor transport (used by malware)
1234, # Netcat / reverse connections
1337, # Common C2 port used by malware
# === ⚠️ Scanner ports and potentially vulnerable services ===
1080, # SOCKS proxy — used to bypass filtering
3128, # Squid proxy — may be abused as open proxy
8000, # Alternative HTTP ports, dev servers
8888, # Web interfaces, proxies, dev tools
10000 # Webmin — remote admin panel, frequent attacks
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; abused by attackers
162 # SNMP Trap — also potentially vulnerable
} drop

# Attention! Blocking wide port ranges — be careful!
# Do not break system or application functionality!

# == TCP port ranges not used by a workstation during transit routing ==
# Blocked to prevent unwanted forwarding, hidden tunnels,
# NAT evasion, parasitic flows, and potential forward-path attacks.

tcp dport {
1024-2047, # System/legacy services; rarely needed in forward
2048-4095, # Proprietary daemons; NFS (2049) — check if used
4096-8191, # Old VPNs, some games, P2P; rarely needed on desktop
8192-12287, # Alternative HTTP/proxy, multimedia; test as needed
12288-16383, # Media/VoIP (TCP fallback); may break calls
16384-24575, # RTP/WebRTC (TCP fallback); block unless AV needed
24576-32767, # Dynamic ranges for games/VPN; may cause issues
32768-49151, # Registered/ephemeral; risky — may break NAT, Docker, VM
49152-65535 # High ephemeral; widely used by modern apps
} drop

# == 🚫 Blocking UDP ports — high and dynamic ranges ==
udp dport {
1024-9999, # low/mid ephemeral ports; used by trojans, P2P, games, VPN
10000-65535 # high ephemeral; used by dynamic apps, VPN, Docker
} drop

# = 🕷️ Suspicious IPs — large ranges often used by botnets, spam nets, and scanners =
ip saddr {
185.0.0.0/8, # abused hosting and proxy networks
37.0.0.0/8, # cheap VPS, frequent scanning sources
88.0.0.0/8, # common brute-force and scanner range
77.0.0.0/8, # TOR/proxy nodes
91.0.0.0/8 # botnets and “grey-zone” hosting
} drop
}

chain output {
# = Main chain policy =
type filter hook output priority 0;
policy accept;

# = Blocking various types of attacks =

# == 🔒 Limiting new connections from a single IP (anti-DDoS) ==
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# = ICMP protocol restrictions =

# == 🛡️ Ping limitation ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == Critically important ICMP for network ==
ip protocol icmp icmp type { destination-unreachable, time-exceeded, parameter-problem } accept

# == Important ICMPv6 for IPv6 ==
ip6 nexthdr icmpv6 icmpv6 type { 1, 2, 3, 4 } accept
ip6 nexthdr icmpv6 icmpv6 type { 135, 136 } accept # NS/NA
ip6 nexthdr icmpv6 icmpv6 type { 133, 134 } accept # RS/RA

# == Drop all other ICMP and ICMPv6 ==
ip protocol icmp drop # drop all other ICMP
ip6 nexthdr icmpv6 drop # drop all other ICMPv6

# = SCTP protocol blocking =
# 99.9% of desktop systems do not use SCTP at all
meta l4proto sctp drop

# = DCCP — Datagram Congestion Control Protocol blocking =
# Not used by any mainstream desktop applications
meta l4proto dccp drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports and ranges required for application functionality ==
tcp dport {
53, # DNS client. Required for Internet to work: domain name resolution (UDP/TCP).
80, # HTTP traffic to unencrypted websites; apps may use it for API/redirects.
443, # HTTPS. Main port for all encrypted web traffic — browsers, API, VPN, updates.
3306, # MySQL client. Needed if you connect to MySQL.
3478, # STUN/TURN WebRTC. Needed for audio/video/Discord.
3000, # Node.js dev servers. Needed for development.
3690, # SVN. If you work with an old repository.
4443, # Alternative HTTPS (some APIs). Also used by some VPN/clients.
12043, # Required for Custom 3D Application.
13000-13050 # Required for Custom 3D Application.
} accept

# == Allow UDP ports and ranges required for applications ==
udp dport {
443, # Required for fast and stable operation of modern websites
# (Google, YouTube, ChatGPT, Cloudflare)
13000-13050 # Required for Custom 3D Application.
} accept

# = Blocking potentially dangerous / unnecessary TCP/UDP ports =

# These blocks are intended for a DESKTOP / workstation.
# ⚠ If you use the system as a SERVER —
# adjust or comment out the required ports/ranges as needed.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high-risk) ===
22, # SSH — target of brute-force attacks.
23, # Telnet — outdated, unencrypted.
3389, # RDP — Windows remote access.
5900, # VNC — remote access, often vulnerable.
# === FTP / SMB / NetBIOS (dangerous file-sharing services) ===
21, # FTP — insecure protocol.
137, # NetBIOS Name Service.
138, # NetBIOS Datagram.
139, # NetBIOS Session.
445, # SMB/CIFS — frequent exploitation target.
# === Databases (NEVER open to the Internet) ===
3306, # MySQL/MariaDB.
1433, # MS SQL Server.
1434, # MS SQL Browser.
# === HTTP-alt/Proxy/Elasticsearch (dangerous, often attacked) ===
8080, # HTTP proxy / web interfaces — often exposed test interfaces.
9200, # Elasticsearch API — full remote access to data.
# === UPnP/IoT (vulnerable by design) ===
1900, # SSDP / UPnP.
# === Common malware ports (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell.
5555, # Android ADB / IoT botnets.
9001, # Tor transport (used by malware).
1234, # Netcat / reverse connections.
1337, # Common C2 malware port.
# === ⚠️ Ports of scanners and potentially vulnerable services ===
1080, # SOCKS proxy — often abused for bypassing filters.
3128, # Squid HTTP proxy — can be used as open proxy.
8000, # Alternative HTTP ports, web services — potentially vulnerable.
8888, # Alternative web interfaces — test and proxy ports.
10000 # Webmin — web admin panel, target of attacks.
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; can be abused by attackers.
162 # SNMP Trap — same, potential vulnerability.
} drop

# Warning! ⚠️ Be careful blocking wide port ranges! ⚠️
# Do not break system or application functionality!
# If you need a range — uncomment.
# If you don’t — comment out.

# == Blocking “dangerous” and desktop-unnecessary TCP port ranges ==
tcp dport {
1-1023, # 🛑 Privileged ports.
1024-2047, # r-commands (rlogin, rsh, rexec), old RPC, NFS, legacy daemons.
2048-3071, # Rare proprietary protocols and middleware.
3072-4999, # Mostly ports of legacy, server, corporate apps;
# rarely needed on workstations.
5000-5999, # Alternative services, old P2P/admin ports, rarely used on desktops.
7000-7999, # Alternative/test ports, often used by trojans.
9000-9999, # Web services, proxies, possible backdoor ports.
10000-19998, # Dynamic/high service ports; may be required by some apps like Custom 3D Application,
# but not needed by most desktop services.
19999-32767 # Old ephemeral port range; used by P2P, games, some VPNs,
# but system services rarely use them.
} drop

# == Blocking “dangerous” and desktop-unnecessary UDP port ranges ==
udp dport {
1024-2047, # Old UNIX services, RPC, NFS, r-commands, legacy daemons.
# Usually safe to block.
2048-4095, # Rarely used standard ports, proprietary services.
# Usually safe to block.
4096-8191, # VPN, games, P2P, WebRTC, VoIP of some clients.
# Can block, but cautiously: may affect VPN/apps.
8192-12287, # QUIC/HTTP3, proxies, multimedia protocols.
# Might cause side effects; better test first.
12288-16383, # Old RTP/VoIP ranges and media streams.
# Can block, but might break video calls.
16384-24575, # Main RTP range (audio/video), WebRTC, VoIP.
# ❗ Do not block if you need video calls/WebRTC/VPN.
24576-32767 # Dynamic ports for VPN, P2P, games, streaming data.
# ❗ May break VPN or some apps.
} drop

# == 🕷️ Blocking suspicious IPs —
# large ranges often used by botnets, spam networks, and scanners ==
ip saddr {
185.0.0.0/8, # Abused hosting and proxy networks.
37.0.0.0/8, # Cheap VPS, scanning sources.
88.0.0.0/8, # Frequent brute-force and scanners.
77.0.0.0/8, # Massive TOR/proxy nodes.
91.0.0.0/8 # Botnets and “grey” hosting.
} drop
}
}

</syntaxhighlight>

====== sysctl config: ======
kernel parameters configuration

/etc/sysctl.d/99-protect.conf<syntaxhighlight lang="bash">
# 1 Ignore ICMP on interfaces
net.ipv4.icmp_echo_ignore_all = 1

# 2 Do not respond to ICMP broadcast (against Smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 3 Enable SYN backlog reduction
net.ipv4.tcp_syncookies = 1

# 4 Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 5 Log packets with incorrect routing
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# 6 Disable ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# 7 Disable packet forwarding
net.ipv4.ip_forward = 0

# 8 Disable IPv6 support
net.ipv4.conf.all.disable_ipv6 = 1
net.ipv4.conf.default.disable_ipv6 = 1

# 9 Prevent sending TCP segments with null windows
net.ipv4.tcp_rfc1337 = 1

# 10 Disable ARP filtering for automatic routing
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1

# 11 Limit the maximum size of the incoming TCP window
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# 12 Drop packets with incorrect checksums
net.ipv4.conf.all.drop_unicast_in_l2_multicast = 1
net.ipv4.conf.default.drop_unicast_in_l2_multicast = 1

# 13 Disable IPv6 forwarding
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# 14 Limit the maximum number of SYN packet retries
net.ipv4.tcp_synack_retries = 2

# 15 Increase routing cache lifetime
net.ipv4.route.max_size = 32768
</syntaxhighlight>

====== auditd rules config: ======
/etc/audit/rules.d/audit.rules

<syntaxhighlight lang="bash">
## Flush rules
-D

## Buffers
-b 8192
--backlog_wait_time 60000
-f 1

## Network audit
-a always,exit -F arch=b64 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b64 -S accept4 -F success=1 -k network_accept
-a always,exit -F arch=b32 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b32 -S accept4 -F success=1 -k network_accept

## Logging execve commands
-a always,exit -F arch=b64 -S execve -F key=exec_log

## Audit logins and sessions
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session

## sudo / su
-w /etc/sudoers -p wa -k sudo
-w /etc/sudoers.d/ -p wa -k sudo
-w /bin/su -p x -k su_cmd

## Account and configuration changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/hosts -p wa -k system_conf
-w /etc/hostname -p wa -k system_conf
-w /etc/resolv.conf -p wa -k system_conf
-w /etc/issue -p wa -k system_conf
-w /etc/network/ -p wa -k system_conf

## Time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -F key=time_change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -F key=time_change

## Audit SSH connections and changes
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /var/log/auth.log -p wa -k ssh_login

## Audit usage of remote tools (e.g., SSH, netcat)
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/nc -k nc_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/nc -k nc_process

## Audit privileged access
-a always,exit -F arch=b64 -S setuid -S setgid -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -S setgid -k privilege_escalation
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/sudoers.d/ -p wa -k sudoers_changes
-w /bin/sudo -p x -k sudo_command

## Monitor credential changes
#-w /root/.ssh/ -p wa -k ssh_keys
#-w /home/*/.ssh/ -p wa -k ssh_keys

## Audit use of remote network services
-a always,exit -F arch=b64 -S socket -F success=1 -k socket_connect
-a always,exit -F arch=b32 -S socket -F success=1 -k socket_connect

# Log package installation and removal via dpkg
-w /usr/bin/dpkg -p x
-w /usr/sbin/apt-get -p x
-w /usr/bin/apt -p x
</syntaxhighlight>

==== UsefulPrograms ====

Here is the list of programs useful for configuring and maintaining the security of Linux systems. The included programs are either open-source (the majority) or commercial, but with freely available limited features sufficient to address core security tasks (a smaller portion).

https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/UsefulPrograms

==== External Resources ====

[https://www.debian.org/doc/manuals/securing-debian-manual/index.en.html|Securing Debian Manual 3.19 — Javier Fernández-Sanguino Peña.]
This document describes security in the Debian project and in the Debian operating system. Starting with the process of securing and hardening the default Debian GNU/Linux distribution installation, it also covers some of the common tasks to set up a secure network environment using Debian GNU/Linux, gives additional information on the security tools available and talks about how security is enforced in Debian by the security and audit team.

[https://medium.com/%40ihouelecaurcy/the-complete-nftables-guide-modern-linux-firewall-mastery-79fb86894d5c|The Complete nftables Guide: Modern Linux Firewall Mastery — Ihouele Caurcy]
The definitive guide to nftables — the modern replacement for iptables, ip6tables, arptables, and ebtables. From basic concepts to enterprise-level configurations.

[https://notes.suhaib.in/docs/tech/utilities/iptables-nftables-and-you-a-friendly-guide-to-traffic-rules/|iptables, nftables, and You A Friendly Guide to Traffic Rules]
A friendly guide to iptables and nftables in Linux: explains Netfilter architecture, tables, chains and rules, with configuration examples (SSH, IP blocking, port forwarding). Covers differences between iptables and nftables, migration, and compatibility with modern firewall tools. Useful for understanding the iptables→nftables transition and practical examples.

[https://public.jdstone1.com/books_and_magazines/Computer_Books/Operating_Systems/SELinux%20System%20Administration%20(3rd%20ed).pdf|SELinux System Administration Third Edition — Sven Vermeulen.]
Implement mandatory access control to secure applications, users, and information flows on Linux.

[https://gitlab.com/apparmor/apparmor/-/wikis/home AppArmor]
The official wiki for the AppArmor security project on Linux. Provides guidance for users and developers, instructions for creating and managing security profiles, example access policies for applications, and best practices to protect the operating system.

[https://nallino.net/stockage/security/Linux_Mint_Security.pdf|Security, Privacy and Anonymity in Linux Mint — Michel Nallino.]
A good and comprehensive work on Linux Mint security that can also be useful for other Linux distributions.

[https://www.cisa.gov/topics/cybersecurity-best-practices|CISA — Cybersecurity Best Practices]
CISA (Certified Information Systems Auditor) provides information on cybersecurity best practices to help individuals and organizations implement preventative measures and manage cyber risks.

==== Provenance ====

This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131

it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks

[[index.php?title=Category:Security]]
[[index.php?title=Category:Hardening]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2025-12-18T18:43:59Z

Blackcat568:

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.
* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

''Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build).''

Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

====== Main Aspects of System Hardening ======

# Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.
# If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to type long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>
# Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.
# Avoid using the superuser account or sudo without a clear necessity — and never execute arbitrary scripts with sudo. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
## Always read a script fully before running it (less script.sh, cat script.sh).
## Never paste commands from untrusted or unverified sources into the terminal.
## Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
## Follow the principle of least privilege — create separate user accounts and limit access rights where possible <blockquote>'''Important:''' Improper or careless use of sudo and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.</blockquote>
# Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. You may also consider switching to SELinux. If you have difficulty configuring AppArmor or SELinux, seek help from specialists or use AI-based tools. My SELinux configuration is attached below (I use SELinux on Debian 12 — it works reliably).
# Use advanced network filtering settings: iptables or nftables, or a commercial firewall. (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#nftables config:|nftables config]]
# Configure kernel parameters for maximum security (sysctl hardening). (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#sysctl config:|sysctl config]])
# Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event). (sample [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#auditd rules config:|auditd rules config]]
# Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.
# If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.
# Follow the principle of Attack Surface Reduction (or [https://en.wikipedia.org/wiki/Occam's_razor Occam's Razor]) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
## If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
## If you are certain you will never use it, remove it completely from the system.
## This practice reduces potential attack vectors and strengthens overall system security.
## Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications.
## Always create a full system backup before making any significant configuration changes or modifications.
# Perform regular antivirus and anti-rootkit scans of the system. In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.
# Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:
<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

====== Related Aspects of Internet Security ======

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

# Store passwords in a reliable password manager.
'''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:
## relying on human memory, with the risk of forgetting or confusing credentials;
## storing passwords on paper media, which can be damaged, lost, or stolen;
## saving passwords in web browsers in unencrypted form;
## keeping passwords in plain text files on the desktop or in other directories without encryption;
and similar approaches.
Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.
A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.
## Regularly create up-to-date backups of the ''encrypted'' password database.
## Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.
Additional Practical Recommendations:
A password manager (for example, KeePassXC) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.
In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.
It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).
# Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [[wikipedia:Authenticator_app|Authenticator_app]]), or a hardware security key such as a [[wikipedia:YubiKey|YubiKey]].
This is a critical cybersecurity measure — neglecting it can completely undermine all your efforts in configuring a secure Linux system.
The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:
## YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
## It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
## Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number. For now, it is one of the most reliable hardware-based options for two-factor authentication.
# Using VPN to improve privacy and security
## ''If you are a private user'', you can also configure a system-wide VPN (for example, ProtonVPN) so that all device traffic is routed through it — not only browser traffic or traffic from specific applications.
Enable the “killswitch” mode and disable it only when necessary, re-enabling it immediately afterwards.
It is also recommended to periodically change VPN servers, doing so at different and unpredictable intervals.
Using a VPN increases your privacy: all of your traffic will be encrypted from observers on your local network and from your internet service provider. This makes it more difficult for an attacker to apply certain social-engineering methods based on traffic analysis, and it also helps protect your privacy in the event that your provider’s infrastructure is compromised.
## ''If you own a server'' and want access to it to be available only to trusted private or legal entities, while also increasing its protection against unauthorized access, you can configure the server so that SSH and other internal services are accessible exclusively through OpenVPN using TLS authentication (tls-auth / tls-crypt) and unique client certificates instead of passwords.
# Actively study and apply artificial intelligence to improve security configurations in Debian and other Linux distributions, as well as to address related cybersecurity tasks. A lack of knowledge often becomes the weakest link; AI can provide accurate, structured recommendations interactively and help automate repetitive or complex operations.
# If privacy is a priority, consider reducing reliance on the Google ecosystem and switching to more privacy-focused alternatives (for example, proton.me and similar services). Google provides very strong security, but its services collect extensive telemetry for analysis. While this data is encrypted and not accessible to attackers, it may still be undesirable for users who value strict privacy.
<blockquote>''Always verify AI-generated recommendations before applying them in production environments. Test any changes in an isolated system, review generated commands or configurations, and ensure that suggestions align with your threat model and security architecture.''

''In practice, users who effectively leverage AI tools are significantly better prepared, and the adoption of such technologies makes malicious activity considerably more difficult for attackers.''

'''''Note:''' Artificial intelligence tools are mentioned here as optional technical aids, not as an endorsement of any specific service or vendor.''</blockquote>
# It is also important to consider the possibility of hardware-level attacks.

Although such attacks are significantly less common and typically require more resources than software-based attacks, they remain a potential threat. In certain scenarios, an adversary may exploit vulnerabilities in device firmware or conduct a combined attack targeting both software and hardware layers. Examples include remote injection of malicious code into the firmware of a motherboard, router, optical modem, or other hardware components.

If, after a thorough software-level audit, a security issue remains unresolved, it is advisable <nowiki>'''</nowiki>to perform a hardware-level assessment<nowiki>'''</nowiki> as well, including verification of device firmware integrity and configuration.

<blockquote>'''And most importantly — give up the illusion of complete security. We live in conditions of a severe information war, and everyone must make efforts so that malicious actors cannot freely spy on desktops and servers.'''</blockquote>

===== Examples of Deep Custom Security Configurations =====

Below are examples of strong, individualized configurations for '''SELinux''', '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

====== SELinux config: ======
<syntaxhighlight lang="terminfo">
root@user:/home/user# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
root@user:/home/user# sestatus -v
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

Process contexts:
Current context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Init context: system_u:system_r:init_t:s0
/sbin/agetty system_u:system_r:getty_t:s0

File contexts:
Controlling terminal: unconfined_u:object_r:user_devpts_t:s0
/etc/passwd system_u:object_r:etc_t:s0
/etc/shadow system_u:object_r:unlabeled_t:s0
/bin/bash system_u:object_r:shell_exec_t:s0
/bin/login system_u:object_r:login_exec_t:s0
/bin/sh system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0
/sbin/agetty system_u:object_r:getty_exec_t:s0
/sbin/init system_u:object_r:bin_t:s0 -> system_u:object_r:init_exec_t:s0
/lib/ld-linux.so.2 system_u:object_r:lib_t:s0 -> system_u:object_r:ld_so_t:s0
</syntaxhighlight>

====== nftables config: ======
<syntaxhighlight lang="bash">
#!/usr/sbin/nft -f

flush ruleset

table inet filter {

# = Main chain policy =
chain input {
type filter hook input priority 0;
policy drop;

# = Common rule set =
# 🌀 Allow loopback interface (internal system processes)
iif "lo" accept

# == 🔁 Allow established and related connections ==
ct state established,related accept

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# == 🔒 Limit the rate of NEW connections per source IP (basic anti-DDoS protection) ==
# If you experience issues with slow or failed page loads in your browser,
# try increasing the limit, for example:
# ip saddr 0.0.0.0/0 ct state new limit rate 50/second burst 100 packets accept
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == 🚫 Blocking SSDP and mDNS (local broadcast discovery protocols) ==
ip daddr 239.255.255.250 udp dport 1900 drop # ❌ SSDP (UPnP/device discovery)
ip daddr 224.0.0.251 udp dport 5353 drop # ❌ mDNS (Bonjour, Avahi)

# == 🛑 Blocking NetBIOS and LLMNR (Windows/systemd internal LAN protocols) ==
udp dport 137 drop # ❌ NetBIOS Name Service (Windows network names)
udp dport 138 drop # ❌ NetBIOS Datagram Service (LAN name discovery)
udp dport 5355 drop # ❌ LLMNR (Link-Local Multicast Name Resolution)

# = Set of blocked IP addresses and ranges =

# == 🧱 Blocking known botnets and proxy networks ==
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} log prefix "🔥 BAN: known bots " flags all
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} drop

# == 🚫 Blocking strange TCP flags (XMAS, NULL scans and others) ==
tcp flags & (fin|syn|rst|psh|ack|urg) == 0 drop # NULL scan
tcp flags & (fin|psh|urg) == (fin|psh|urg) drop # XMAS scan
tcp flags & (fin|syn) == (fin|syn) drop # SYN-ACK scan
tcp flags & (syn|rst|fin) == (syn|rst|fin) drop # Xmas scan
tcp flags & (syn|fin|rst|psh|ack) == (syn|rst|fin|ack) drop # Xmas scan

# == 🚫 Blocking fragmented packets — commonly used in filter evasion ==
ip frag-off & 0x1fff != 0 drop

# == 🔒 Blocking spoofed IP packets ==
ip saddr 127.0.0.0/8 drop # localhost
ip saddr 10.0.0.0/8 drop # private network
ip saddr 172.16.0.0/12 drop # private network
ip saddr 192.168.0.0/16 drop # private network
ip saddr 169.254.0.0/16 drop # APIPA
ip saddr 0.0.0.0/8 drop # invalid address
ip saddr 224.0.0.0/4 drop # multicast
ip saddr 240.0.0.0/5 drop # reserved
}

# = Main chain policy =
chain forward {
type filter hook forward priority 0;
policy accept;

# = Blocking various types of attacks =
# Required in chain forward only if Docker or Oracle VirtualBox is present.
# If needed — uncomment.

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
# ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
# ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
# ip protocol icmp icmp type echo-request limit rate 1/second accept
# ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
# ip protocol icmp icmp type echo-request drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports required for application operation ==
tcp dport {
53, # DNS — needed for domain name resolution
80, # HTTP — web traffic, updates and resource loading
443, # HTTPS — secure web traffic, VPN, browser
12043, # Custom 3D Application — specific client port
13000-13050 # Custom 3D Application — dynamic client port range
} accept

# == Allow UDP ports required for application operation ==
udp dport {
53, # DNS — needed for domain name resolution
443, # HTTPS via QUIC/HTTP3, browser protocols
3478, # STUN/TURN — WebRTC and video calls
3479-3481 # STUN/TURN — WebRTC and video calls
} accept

# = Blocking dangerous and unnecessary TCP/UDP ports and ranges =

# These blocklists are intended for a DESKTOP / workstation.
# They block remote access, outdated services, proxies, DBs, IoT, and ports
# often used by malware, scanners, and C2 infrastructures.
#
# ⚠ If you use the system as a SERVER, enable IP forwarding,
# or run services with internal routing
# (Docker NAT/bridge, VirtualBox host-only/bridged, VPN clients),
# carefully review the blocked ports/ranges in the forward chain —
# these services may need extra ports.
# Adjust or comment out required items if necessary.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high risk) ===
22, # SSH — common brute-force target
23, # Telnet — outdated, no encryption
3389, # RDP — Windows remote desktop
5900, # VNC — remote access, frequent vulnerabilities
# === FTP / SMB / NetBIOS (unsafe file-sharing protocols) ===
21, # FTP — insecure protocol
137, # NetBIOS Name Service
138, # NetBIOS Datagram
139, # NetBIOS Session
445, # SMB/CIFS — common exploit target
# === Databases (NEVER expose to the Internet) ===
3306, # MySQL/MariaDB
1433, # MS SQL Server
1434, # MS SQL Browser
# === HTTP-alt/Proxy/Elasticsearch (exploited frequently) ===
8080, # HTTP proxy / web interfaces — often exposed accidentally
9200, # Elasticsearch API — full remote data access
# === UPnP/IoT (insecure by design) ===
1900, # SSDP / UPnP
# === Common for malware (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell
5555, # Android ADB / IoT botnets
9001, # Tor transport (used by malware)
1234, # Netcat / reverse connections
1337, # Common C2 port used by malware
# === ⚠️ Scanner ports and potentially vulnerable services ===
1080, # SOCKS proxy — used to bypass filtering
3128, # Squid proxy — may be abused as open proxy
8000, # Alternative HTTP ports, dev servers
8888, # Web interfaces, proxies, dev tools
10000 # Webmin — remote admin panel, frequent attacks
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; abused by attackers
162 # SNMP Trap — also potentially vulnerable
} drop

# Attention! Blocking wide port ranges — be careful!
# Do not break system or application functionality!

# == TCP port ranges not used by a workstation during transit routing ==
# Blocked to prevent unwanted forwarding, hidden tunnels,
# NAT evasion, parasitic flows, and potential forward-path attacks.

tcp dport {
1024-2047, # System/legacy services; rarely needed in forward
2048-4095, # Proprietary daemons; NFS (2049) — check if used
4096-8191, # Old VPNs, some games, P2P; rarely needed on desktop
8192-12287, # Alternative HTTP/proxy, multimedia; test as needed
12288-16383, # Media/VoIP (TCP fallback); may break calls
16384-24575, # RTP/WebRTC (TCP fallback); block unless AV needed
24576-32767, # Dynamic ranges for games/VPN; may cause issues
32768-49151, # Registered/ephemeral; risky — may break NAT, Docker, VM
49152-65535 # High ephemeral; widely used by modern apps
} drop

# == 🚫 Blocking UDP ports — high and dynamic ranges ==
udp dport {
1024-9999, # low/mid ephemeral ports; used by trojans, P2P, games, VPN
10000-65535 # high ephemeral; used by dynamic apps, VPN, Docker
} drop

# = 🕷️ Suspicious IPs — large ranges often used by botnets, spam nets, and scanners =
ip saddr {
185.0.0.0/8, # abused hosting and proxy networks
37.0.0.0/8, # cheap VPS, frequent scanning sources
88.0.0.0/8, # common brute-force and scanner range
77.0.0.0/8, # TOR/proxy nodes
91.0.0.0/8 # botnets and “grey-zone” hosting
} drop
}

chain output {
# = Main chain policy =
type filter hook output priority 0;
policy accept;

# = Blocking various types of attacks =

# == 🔒 Limiting new connections from a single IP (anti-DDoS) ==
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# = ICMP protocol restrictions =

# == 🛡️ Ping limitation ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == Critically important ICMP for network ==
ip protocol icmp icmp type { destination-unreachable, time-exceeded, parameter-problem } accept

# == Important ICMPv6 for IPv6 ==
ip6 nexthdr icmpv6 icmpv6 type { 1, 2, 3, 4 } accept
ip6 nexthdr icmpv6 icmpv6 type { 135, 136 } accept # NS/NA
ip6 nexthdr icmpv6 icmpv6 type { 133, 134 } accept # RS/RA

# == Drop all other ICMP and ICMPv6 ==
ip protocol icmp drop # drop all other ICMP
ip6 nexthdr icmpv6 drop # drop all other ICMPv6

# = SCTP protocol blocking =
# 99.9% of desktop systems do not use SCTP at all
meta l4proto sctp drop

# = DCCP — Datagram Congestion Control Protocol blocking =
# Not used by any mainstream desktop applications
meta l4proto dccp drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports and ranges required for application functionality ==
tcp dport {
53, # DNS client. Required for Internet to work: domain name resolution (UDP/TCP).
80, # HTTP traffic to unencrypted websites; apps may use it for API/redirects.
443, # HTTPS. Main port for all encrypted web traffic — browsers, API, VPN, updates.
3306, # MySQL client. Needed if you connect to MySQL.
3478, # STUN/TURN WebRTC. Needed for audio/video/Discord.
3000, # Node.js dev servers. Needed for development.
3690, # SVN. If you work with an old repository.
4443, # Alternative HTTPS (some APIs). Also used by some VPN/clients.
12043, # Required for Custom 3D Application.
13000-13050 # Required for Custom 3D Application.
} accept

# == Allow UDP ports and ranges required for applications ==
udp dport {
443, # Required for fast and stable operation of modern websites
# (Google, YouTube, ChatGPT, Cloudflare)
13000-13050 # Required for Custom 3D Application.
} accept

# = Blocking potentially dangerous / unnecessary TCP/UDP ports =

# These blocks are intended for a DESKTOP / workstation.
# ⚠ If you use the system as a SERVER —
# adjust or comment out the required ports/ranges as needed.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high-risk) ===
22, # SSH — target of brute-force attacks.
23, # Telnet — outdated, unencrypted.
3389, # RDP — Windows remote access.
5900, # VNC — remote access, often vulnerable.
# === FTP / SMB / NetBIOS (dangerous file-sharing services) ===
21, # FTP — insecure protocol.
137, # NetBIOS Name Service.
138, # NetBIOS Datagram.
139, # NetBIOS Session.
445, # SMB/CIFS — frequent exploitation target.
# === Databases (NEVER open to the Internet) ===
3306, # MySQL/MariaDB.
1433, # MS SQL Server.
1434, # MS SQL Browser.
# === HTTP-alt/Proxy/Elasticsearch (dangerous, often attacked) ===
8080, # HTTP proxy / web interfaces — often exposed test interfaces.
9200, # Elasticsearch API — full remote access to data.
# === UPnP/IoT (vulnerable by design) ===
1900, # SSDP / UPnP.
# === Common malware ports (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell.
5555, # Android ADB / IoT botnets.
9001, # Tor transport (used by malware).
1234, # Netcat / reverse connections.
1337, # Common C2 malware port.
# === ⚠️ Ports of scanners and potentially vulnerable services ===
1080, # SOCKS proxy — often abused for bypassing filters.
3128, # Squid HTTP proxy — can be used as open proxy.
8000, # Alternative HTTP ports, web services — potentially vulnerable.
8888, # Alternative web interfaces — test and proxy ports.
10000 # Webmin — web admin panel, target of attacks.
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; can be abused by attackers.
162 # SNMP Trap — same, potential vulnerability.
} drop

# Warning! ⚠️ Be careful blocking wide port ranges! ⚠️
# Do not break system or application functionality!
# If you need a range — uncomment.
# If you don’t — comment out.

# == Blocking “dangerous” and desktop-unnecessary TCP port ranges ==
tcp dport {
1-1023, # 🛑 Privileged ports.
1024-2047, # r-commands (rlogin, rsh, rexec), old RPC, NFS, legacy daemons.
2048-3071, # Rare proprietary protocols and middleware.
3072-4999, # Mostly ports of legacy, server, corporate apps;
# rarely needed on workstations.
5000-5999, # Alternative services, old P2P/admin ports, rarely used on desktops.
7000-7999, # Alternative/test ports, often used by trojans.
9000-9999, # Web services, proxies, possible backdoor ports.
10000-19998, # Dynamic/high service ports; may be required by some apps like Custom 3D Application,
# but not needed by most desktop services.
19999-32767 # Old ephemeral port range; used by P2P, games, some VPNs,
# but system services rarely use them.
} drop

# == Blocking “dangerous” and desktop-unnecessary UDP port ranges ==
udp dport {
1024-2047, # Old UNIX services, RPC, NFS, r-commands, legacy daemons.
# Usually safe to block.
2048-4095, # Rarely used standard ports, proprietary services.
# Usually safe to block.
4096-8191, # VPN, games, P2P, WebRTC, VoIP of some clients.
# Can block, but cautiously: may affect VPN/apps.
8192-12287, # QUIC/HTTP3, proxies, multimedia protocols.
# Might cause side effects; better test first.
12288-16383, # Old RTP/VoIP ranges and media streams.
# Can block, but might break video calls.
16384-24575, # Main RTP range (audio/video), WebRTC, VoIP.
# ❗ Do not block if you need video calls/WebRTC/VPN.
24576-32767 # Dynamic ports for VPN, P2P, games, streaming data.
# ❗ May break VPN or some apps.
} drop

# == 🕷️ Blocking suspicious IPs —
# large ranges often used by botnets, spam networks, and scanners ==
ip saddr {
185.0.0.0/8, # Abused hosting and proxy networks.
37.0.0.0/8, # Cheap VPS, scanning sources.
88.0.0.0/8, # Frequent brute-force and scanners.
77.0.0.0/8, # Massive TOR/proxy nodes.
91.0.0.0/8 # Botnets and “grey” hosting.
} drop
}
}

</syntaxhighlight>

====== sysctl config: ======
kernel parameters configuration

/etc/sysctl.d/99-protect.conf<syntaxhighlight lang="bash">
# 1 Ignore ICMP on interfaces
net.ipv4.icmp_echo_ignore_all = 1

# 2 Do not respond to ICMP broadcast (against Smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 3 Enable SYN backlog reduction
net.ipv4.tcp_syncookies = 1

# 4 Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 5 Log packets with incorrect routing
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# 6 Disable ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# 7 Disable packet forwarding
net.ipv4.ip_forward = 0

# 8 Disable IPv6 support
net.ipv4.conf.all.disable_ipv6 = 1
net.ipv4.conf.default.disable_ipv6 = 1

# 9 Prevent sending TCP segments with null windows
net.ipv4.tcp_rfc1337 = 1

# 10 Disable ARP filtering for automatic routing
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1

# 11 Limit the maximum size of the incoming TCP window
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# 12 Drop packets with incorrect checksums
net.ipv4.conf.all.drop_unicast_in_l2_multicast = 1
net.ipv4.conf.default.drop_unicast_in_l2_multicast = 1

# 13 Disable IPv6 forwarding
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# 14 Limit the maximum number of SYN packet retries
net.ipv4.tcp_synack_retries = 2

# 15 Increase routing cache lifetime
net.ipv4.route.max_size = 32768
</syntaxhighlight>

====== auditd rules config: ======
/etc/audit/rules.d/audit.rules

<syntaxhighlight lang="bash">
## Flush rules
-D

## Buffers
-b 8192
--backlog_wait_time 60000
-f 1

## Network audit
-a always,exit -F arch=b64 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b64 -S accept4 -F success=1 -k network_accept
-a always,exit -F arch=b32 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b32 -S accept4 -F success=1 -k network_accept

## Logging execve commands
-a always,exit -F arch=b64 -S execve -F key=exec_log

## Audit logins and sessions
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session

## sudo / su
-w /etc/sudoers -p wa -k sudo
-w /etc/sudoers.d/ -p wa -k sudo
-w /bin/su -p x -k su_cmd

## Account and configuration changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/hosts -p wa -k system_conf
-w /etc/hostname -p wa -k system_conf
-w /etc/resolv.conf -p wa -k system_conf
-w /etc/issue -p wa -k system_conf
-w /etc/network/ -p wa -k system_conf

## Time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -F key=time_change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -F key=time_change

## Audit SSH connections and changes
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /var/log/auth.log -p wa -k ssh_login

## Audit usage of remote tools (e.g., SSH, netcat)
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/nc -k nc_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/nc -k nc_process

## Audit privileged access
-a always,exit -F arch=b64 -S setuid -S setgid -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -S setgid -k privilege_escalation
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/sudoers.d/ -p wa -k sudoers_changes
-w /bin/sudo -p x -k sudo_command

## Monitor credential changes
#-w /root/.ssh/ -p wa -k ssh_keys
#-w /home/*/.ssh/ -p wa -k ssh_keys

## Audit use of remote network services
-a always,exit -F arch=b64 -S socket -F success=1 -k socket_connect
-a always,exit -F arch=b32 -S socket -F success=1 -k socket_connect

# Log package installation and removal via dpkg
-w /usr/bin/dpkg -p x
-w /usr/sbin/apt-get -p x
-w /usr/bin/apt -p x
</syntaxhighlight>

==== UsefulPrograms ====

Here is the list of programs useful for configuring and maintaining the security of Linux systems. The included programs are either open-source (the majority) or commercial, but with freely available limited features sufficient to address core security tasks (a smaller portion).

https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/UsefulPrograms

==== External Resources ====

[https://www.debian.org/doc/manuals/securing-debian-manual/index.en.html|Securing Debian Manual 3.19 — Javier Fernández-Sanguino Peña.]
This document describes security in the Debian project and in the Debian operating system. Starting with the process of securing and hardening the default Debian GNU/Linux distribution installation, it also covers some of the common tasks to set up a secure network environment using Debian GNU/Linux, gives additional information on the security tools available and talks about how security is enforced in Debian by the security and audit team.

[https://medium.com/%40ihouelecaurcy/the-complete-nftables-guide-modern-linux-firewall-mastery-79fb86894d5c|The Complete nftables Guide: Modern Linux Firewall Mastery — Ihouele Caurcy]
The definitive guide to nftables — the modern replacement for iptables, ip6tables, arptables, and ebtables. From basic concepts to enterprise-level configurations.

[https://notes.suhaib.in/docs/tech/utilities/iptables-nftables-and-you-a-friendly-guide-to-traffic-rules/|iptables, nftables, and You A Friendly Guide to Traffic Rules]
A friendly guide to iptables and nftables in Linux: explains Netfilter architecture, tables, chains and rules, with configuration examples (SSH, IP blocking, port forwarding). Covers differences between iptables and nftables, migration, and compatibility with modern firewall tools. Useful for understanding the iptables→nftables transition and practical examples.

[https://public.jdstone1.com/books_and_magazines/Computer_Books/Operating_Systems/SELinux%20System%20Administration%20(3rd%20ed).pdf|SELinux System Administration Third Edition — Sven Vermeulen.]
Implement mandatory access control to secure applications, users, and information flows on Linux.

[https://gitlab.com/apparmor/apparmor/-/wikis/home AppArmor]
The official wiki for the AppArmor security project on Linux. Provides guidance for users and developers, instructions for creating and managing security profiles, example access policies for applications, and best practices to protect the operating system.

[https://nallino.net/stockage/security/Linux_Mint_Security.pdf|Security, Privacy and Anonymity in Linux Mint — Michel Nallino.]
A good and comprehensive work on Linux Mint security that can also be useful for other Linux distributions.

[https://www.cisa.gov/topics/cybersecurity-best-practices|CISA — Cybersecurity Best Practices]
CISA (Certified Information Systems Auditor) provides information on cybersecurity best practices to help individuals and organizations implement preventative measures and manage cyber risks.

==== Provenance ====

This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131

it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks

[[index.php?title=Category:Security]]
[[index.php?title=Category:Hardening]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2025-12-18T16:59:09Z

Blackcat568:

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.

* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

''Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build).''

Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

====== Main Aspects of System Hardening ======

# Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.
# If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to type long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>
# Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.
# Avoid using the superuser account or sudo without a clear necessity — and never execute arbitrary scripts with sudo. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
## Always read a script fully before running it (less script.sh, cat script.sh).
## Never paste commands from untrusted or unverified sources into the terminal.
## Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
## Follow the principle of least privilege — create separate user accounts and limit access rights where possible <blockquote>'''Important:''' Improper or careless use of sudo and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.</blockquote>
# Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. You may also consider switching to SELinux. If you have difficulty configuring AppArmor or SELinux, seek help from specialists or use AI-based tools. My SELinux configuration is attached below (I use SELinux on Debian 12 — it works reliably).
# Use advanced network filtering settings: iptables or nftables, or a commercial firewall. (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#nftables config:|nftables config]]
# Configure kernel parameters for maximum security (sysctl hardening). (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#sysctl config:|sysctl config]])
# Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event). (sample [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#auditd rules config:|auditd rules config]]
# Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.
# If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.
# Follow the principle of Attack Surface Reduction (or [https://en.wikipedia.org/wiki/Occam's_razor Occam's Razor]) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
## If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
## If you are certain you will never use it, remove it completely from the system.
## This practice reduces potential attack vectors and strengthens overall system security.
## Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications.
## Always create a full system backup before making any significant configuration changes or modifications.
# Perform regular antivirus and anti-rootkit scans of the system. In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.
# Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:
<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

====== Related Aspects of Internet Security ======

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

# Store passwords in a reliable password manager.

'''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:

## relying on human memory, with the risk of forgetting or confusing credentials;
## storing passwords on paper media, which can be damaged, lost, or stolen;
## saving passwords in web browsers in unencrypted form;
## keeping passwords in plain text files on the desktop or in other directories without encryption;
and similar approaches.

Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.

A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.

* Regularly create up-to-date backups of the ''encrypted'' password database.

* Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.

Additional Practical Recommendations

A password manager (for example, KeePassXC) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.

In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.

It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).

# Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [[wikipedia:Authenticator_app|Authenticator_app]]), or a hardware security key such as a [[wikipedia:YubiKey|YubiKey]].

This is a critical cybersecurity measure — neglecting it can completely undermine all your efforts in configuring a secure Linux system.

The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:

* YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
* It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
* Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number. For now, it is one of the most reliable hardware-based options for two-factor authentication.

# Using VPN to improve privacy and security

''If you are a private user'', you can also configure a system-wide VPN (for example, ProtonVPN) so that all device traffic is routed through it — not only browser traffic or traffic from specific applications.

Enable the “killswitch” mode and disable it only when necessary, re-enabling it immediately afterwards.

It is also recommended to periodically change VPN servers, doing so at different and unpredictable intervals.

Using a VPN increases your privacy: all of your traffic will be encrypted from observers on your local network and from your internet service provider. This makes it more difficult for an attacker to apply certain social-engineering methods based on traffic analysis, and it also helps protect your privacy in the event that your provider’s infrastructure is compromised.

''If you own a server'' and want access to it to be available only to trusted private or legal entities, while also increasing its protection against unauthorized access, you can configure the server so that SSH and other internal services are accessible exclusively through OpenVPN using TLS authentication (tls-auth / tls-crypt) and unique client certificates instead of passwords.

# Actively study and apply artificial intelligence to improve security configurations in Debian and other Linux distributions, as well as to address related cybersecurity tasks. A lack of knowledge often becomes the weakest link; AI can provide accurate, structured recommendations interactively and help automate repetitive or complex operations.

# If privacy is a priority, consider reducing reliance on the Google ecosystem and switching to more privacy-focused alternatives (for example, proton.me and similar services). Google provides very strong security, but its services collect extensive telemetry for analysis. While this data is encrypted and not accessible to attackers, it may still be undesirable for users who value strict privacy.

''Always verify AI-generated recommendations before applying them in production environments. Test any changes in an isolated system, review generated commands or configurations, and ensure that suggestions align with your threat model and security architecture.''

''In practice, users who effectively leverage AI tools are significantly better prepared, and the adoption of such technologies makes malicious activity considerably more difficult for attackers.''

'''''Note:''' Artificial intelligence tools are mentioned here as optional technical aids, not as an endorsement of any specific service or vendor.''

# It is also important to consider the possibility of hardware-level attacks.

Although such attacks are significantly less common and typically require more resources than software-based attacks, they remain a potential threat. In certain scenarios, an adversary may exploit vulnerabilities in device firmware or conduct a combined attack targeting both software and hardware layers. Examples include remote injection of malicious code into the firmware of a motherboard, router, optical modem, or other hardware components.

If, after a thorough software-level audit, a security issue remains unresolved, it is advisable <nowiki>'''</nowiki>to perform a hardware-level assessment<nowiki>'''</nowiki> as well, including verification of device firmware integrity and configuration.

<blockquote>'''And most importantly — give up the illusion of complete security. We live in conditions of a severe information war, and everyone must make efforts so that malicious actors cannot freely spy on desktops and servers.'''</blockquote>

===== Examples of Deep Custom Security Configurations =====

Below are examples of strong, individualized configurations for '''SELinux''', '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

====== SELinux config: ======
<syntaxhighlight lang="terminfo">
root@user:/home/user# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
root@user:/home/user# sestatus -v
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

Process contexts:
Current context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Init context: system_u:system_r:init_t:s0
/sbin/agetty system_u:system_r:getty_t:s0

File contexts:
Controlling terminal: unconfined_u:object_r:user_devpts_t:s0
/etc/passwd system_u:object_r:etc_t:s0
/etc/shadow system_u:object_r:unlabeled_t:s0
/bin/bash system_u:object_r:shell_exec_t:s0
/bin/login system_u:object_r:login_exec_t:s0
/bin/sh system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0
/sbin/agetty system_u:object_r:getty_exec_t:s0
/sbin/init system_u:object_r:bin_t:s0 -> system_u:object_r:init_exec_t:s0
/lib/ld-linux.so.2 system_u:object_r:lib_t:s0 -> system_u:object_r:ld_so_t:s0
</syntaxhighlight>

====== nftables config: ======
<syntaxhighlight lang="bash">
#!/usr/sbin/nft -f

flush ruleset

table inet filter {

# = Main chain policy =
chain input {
type filter hook input priority 0;
policy drop;

# = Common rule set =
# 🌀 Allow loopback interface (internal system processes)
iif "lo" accept

# == 🔁 Allow established and related connections ==
ct state established,related accept

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# == 🔒 Limit the rate of NEW connections per source IP (basic anti-DDoS protection) ==
# If you experience issues with slow or failed page loads in your browser,
# try increasing the limit, for example:
# ip saddr 0.0.0.0/0 ct state new limit rate 50/second burst 100 packets accept
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == 🚫 Blocking SSDP and mDNS (local broadcast discovery protocols) ==
ip daddr 239.255.255.250 udp dport 1900 drop # ❌ SSDP (UPnP/device discovery)
ip daddr 224.0.0.251 udp dport 5353 drop # ❌ mDNS (Bonjour, Avahi)

# == 🛑 Blocking NetBIOS and LLMNR (Windows/systemd internal LAN protocols) ==
udp dport 137 drop # ❌ NetBIOS Name Service (Windows network names)
udp dport 138 drop # ❌ NetBIOS Datagram Service (LAN name discovery)
udp dport 5355 drop # ❌ LLMNR (Link-Local Multicast Name Resolution)

# = Set of blocked IP addresses and ranges =

# == 🧱 Blocking known botnets and proxy networks ==
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} log prefix "🔥 BAN: known bots " flags all
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} drop

# == 🚫 Blocking strange TCP flags (XMAS, NULL scans and others) ==
tcp flags & (fin|syn|rst|psh|ack|urg) == 0 drop # NULL scan
tcp flags & (fin|psh|urg) == (fin|psh|urg) drop # XMAS scan
tcp flags & (fin|syn) == (fin|syn) drop # SYN-ACK scan
tcp flags & (syn|rst|fin) == (syn|rst|fin) drop # Xmas scan
tcp flags & (syn|fin|rst|psh|ack) == (syn|rst|fin|ack) drop # Xmas scan

# == 🚫 Blocking fragmented packets — commonly used in filter evasion ==
ip frag-off & 0x1fff != 0 drop

# == 🔒 Blocking spoofed IP packets ==
ip saddr 127.0.0.0/8 drop # localhost
ip saddr 10.0.0.0/8 drop # private network
ip saddr 172.16.0.0/12 drop # private network
ip saddr 192.168.0.0/16 drop # private network
ip saddr 169.254.0.0/16 drop # APIPA
ip saddr 0.0.0.0/8 drop # invalid address
ip saddr 224.0.0.0/4 drop # multicast
ip saddr 240.0.0.0/5 drop # reserved
}

# = Main chain policy =
chain forward {
type filter hook forward priority 0;
policy accept;

# = Blocking various types of attacks =
# Required in chain forward only if Docker or Oracle VirtualBox is present.
# If needed — uncomment.

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
# ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
# ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
# ip protocol icmp icmp type echo-request limit rate 1/second accept
# ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
# ip protocol icmp icmp type echo-request drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports required for application operation ==
tcp dport {
53, # DNS — needed for domain name resolution
80, # HTTP — web traffic, updates and resource loading
443, # HTTPS — secure web traffic, VPN, browser
12043, # Custom 3D Application — specific client port
13000-13050 # Custom 3D Application — dynamic client port range
} accept

# == Allow UDP ports required for application operation ==
udp dport {
53, # DNS — needed for domain name resolution
443, # HTTPS via QUIC/HTTP3, browser protocols
3478, # STUN/TURN — WebRTC and video calls
3479-3481 # STUN/TURN — WebRTC and video calls
} accept

# = Blocking dangerous and unnecessary TCP/UDP ports and ranges =

# These blocklists are intended for a DESKTOP / workstation.
# They block remote access, outdated services, proxies, DBs, IoT, and ports
# often used by malware, scanners, and C2 infrastructures.
#
# ⚠ If you use the system as a SERVER, enable IP forwarding,
# or run services with internal routing
# (Docker NAT/bridge, VirtualBox host-only/bridged, VPN clients),
# carefully review the blocked ports/ranges in the forward chain —
# these services may need extra ports.
# Adjust or comment out required items if necessary.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high risk) ===
22, # SSH — common brute-force target
23, # Telnet — outdated, no encryption
3389, # RDP — Windows remote desktop
5900, # VNC — remote access, frequent vulnerabilities
# === FTP / SMB / NetBIOS (unsafe file-sharing protocols) ===
21, # FTP — insecure protocol
137, # NetBIOS Name Service
138, # NetBIOS Datagram
139, # NetBIOS Session
445, # SMB/CIFS — common exploit target
# === Databases (NEVER expose to the Internet) ===
3306, # MySQL/MariaDB
1433, # MS SQL Server
1434, # MS SQL Browser
# === HTTP-alt/Proxy/Elasticsearch (exploited frequently) ===
8080, # HTTP proxy / web interfaces — often exposed accidentally
9200, # Elasticsearch API — full remote data access
# === UPnP/IoT (insecure by design) ===
1900, # SSDP / UPnP
# === Common for malware (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell
5555, # Android ADB / IoT botnets
9001, # Tor transport (used by malware)
1234, # Netcat / reverse connections
1337, # Common C2 port used by malware
# === ⚠️ Scanner ports and potentially vulnerable services ===
1080, # SOCKS proxy — used to bypass filtering
3128, # Squid proxy — may be abused as open proxy
8000, # Alternative HTTP ports, dev servers
8888, # Web interfaces, proxies, dev tools
10000 # Webmin — remote admin panel, frequent attacks
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; abused by attackers
162 # SNMP Trap — also potentially vulnerable
} drop

# Attention! Blocking wide port ranges — be careful!
# Do not break system or application functionality!

# == TCP port ranges not used by a workstation during transit routing ==
# Blocked to prevent unwanted forwarding, hidden tunnels,
# NAT evasion, parasitic flows, and potential forward-path attacks.

tcp dport {
1024-2047, # System/legacy services; rarely needed in forward
2048-4095, # Proprietary daemons; NFS (2049) — check if used
4096-8191, # Old VPNs, some games, P2P; rarely needed on desktop
8192-12287, # Alternative HTTP/proxy, multimedia; test as needed
12288-16383, # Media/VoIP (TCP fallback); may break calls
16384-24575, # RTP/WebRTC (TCP fallback); block unless AV needed
24576-32767, # Dynamic ranges for games/VPN; may cause issues
32768-49151, # Registered/ephemeral; risky — may break NAT, Docker, VM
49152-65535 # High ephemeral; widely used by modern apps
} drop

# == 🚫 Blocking UDP ports — high and dynamic ranges ==
udp dport {
1024-9999, # low/mid ephemeral ports; used by trojans, P2P, games, VPN
10000-65535 # high ephemeral; used by dynamic apps, VPN, Docker
} drop

# = 🕷️ Suspicious IPs — large ranges often used by botnets, spam nets, and scanners =
ip saddr {
185.0.0.0/8, # abused hosting and proxy networks
37.0.0.0/8, # cheap VPS, frequent scanning sources
88.0.0.0/8, # common brute-force and scanner range
77.0.0.0/8, # TOR/proxy nodes
91.0.0.0/8 # botnets and “grey-zone” hosting
} drop
}

chain output {
# = Main chain policy =
type filter hook output priority 0;
policy accept;

# = Blocking various types of attacks =

# == 🔒 Limiting new connections from a single IP (anti-DDoS) ==
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# = ICMP protocol restrictions =

# == 🛡️ Ping limitation ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == Critically important ICMP for network ==
ip protocol icmp icmp type { destination-unreachable, time-exceeded, parameter-problem } accept

# == Important ICMPv6 for IPv6 ==
ip6 nexthdr icmpv6 icmpv6 type { 1, 2, 3, 4 } accept
ip6 nexthdr icmpv6 icmpv6 type { 135, 136 } accept # NS/NA
ip6 nexthdr icmpv6 icmpv6 type { 133, 134 } accept # RS/RA

# == Drop all other ICMP and ICMPv6 ==
ip protocol icmp drop # drop all other ICMP
ip6 nexthdr icmpv6 drop # drop all other ICMPv6

# = SCTP protocol blocking =
# 99.9% of desktop systems do not use SCTP at all
meta l4proto sctp drop

# = DCCP — Datagram Congestion Control Protocol blocking =
# Not used by any mainstream desktop applications
meta l4proto dccp drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports and ranges required for application functionality ==
tcp dport {
53, # DNS client. Required for Internet to work: domain name resolution (UDP/TCP).
80, # HTTP traffic to unencrypted websites; apps may use it for API/redirects.
443, # HTTPS. Main port for all encrypted web traffic — browsers, API, VPN, updates.
3306, # MySQL client. Needed if you connect to MySQL.
3478, # STUN/TURN WebRTC. Needed for audio/video/Discord.
3000, # Node.js dev servers. Needed for development.
3690, # SVN. If you work with an old repository.
4443, # Alternative HTTPS (some APIs). Also used by some VPN/clients.
12043, # Required for Custom 3D Application.
13000-13050 # Required for Custom 3D Application.
} accept

# == Allow UDP ports and ranges required for applications ==
udp dport {
443, # Required for fast and stable operation of modern websites
# (Google, YouTube, ChatGPT, Cloudflare)
13000-13050 # Required for Custom 3D Application.
} accept

# = Blocking potentially dangerous / unnecessary TCP/UDP ports =

# These blocks are intended for a DESKTOP / workstation.
# ⚠ If you use the system as a SERVER —
# adjust or comment out the required ports/ranges as needed.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high-risk) ===
22, # SSH — target of brute-force attacks.
23, # Telnet — outdated, unencrypted.
3389, # RDP — Windows remote access.
5900, # VNC — remote access, often vulnerable.
# === FTP / SMB / NetBIOS (dangerous file-sharing services) ===
21, # FTP — insecure protocol.
137, # NetBIOS Name Service.
138, # NetBIOS Datagram.
139, # NetBIOS Session.
445, # SMB/CIFS — frequent exploitation target.
# === Databases (NEVER open to the Internet) ===
3306, # MySQL/MariaDB.
1433, # MS SQL Server.
1434, # MS SQL Browser.
# === HTTP-alt/Proxy/Elasticsearch (dangerous, often attacked) ===
8080, # HTTP proxy / web interfaces — often exposed test interfaces.
9200, # Elasticsearch API — full remote access to data.
# === UPnP/IoT (vulnerable by design) ===
1900, # SSDP / UPnP.
# === Common malware ports (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell.
5555, # Android ADB / IoT botnets.
9001, # Tor transport (used by malware).
1234, # Netcat / reverse connections.
1337, # Common C2 malware port.
# === ⚠️ Ports of scanners and potentially vulnerable services ===
1080, # SOCKS proxy — often abused for bypassing filters.
3128, # Squid HTTP proxy — can be used as open proxy.
8000, # Alternative HTTP ports, web services — potentially vulnerable.
8888, # Alternative web interfaces — test and proxy ports.
10000 # Webmin — web admin panel, target of attacks.
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; can be abused by attackers.
162 # SNMP Trap — same, potential vulnerability.
} drop

# Warning! ⚠️ Be careful blocking wide port ranges! ⚠️
# Do not break system or application functionality!
# If you need a range — uncomment.
# If you don’t — comment out.

# == Blocking “dangerous” and desktop-unnecessary TCP port ranges ==
tcp dport {
1-1023, # 🛑 Privileged ports.
1024-2047, # r-commands (rlogin, rsh, rexec), old RPC, NFS, legacy daemons.
2048-3071, # Rare proprietary protocols and middleware.
3072-4999, # Mostly ports of legacy, server, corporate apps;
# rarely needed on workstations.
5000-5999, # Alternative services, old P2P/admin ports, rarely used on desktops.
7000-7999, # Alternative/test ports, often used by trojans.
9000-9999, # Web services, proxies, possible backdoor ports.
10000-19998, # Dynamic/high service ports; may be required by some apps like Custom 3D Application,
# but not needed by most desktop services.
19999-32767 # Old ephemeral port range; used by P2P, games, some VPNs,
# but system services rarely use them.
} drop

# == Blocking “dangerous” and desktop-unnecessary UDP port ranges ==
udp dport {
1024-2047, # Old UNIX services, RPC, NFS, r-commands, legacy daemons.
# Usually safe to block.
2048-4095, # Rarely used standard ports, proprietary services.
# Usually safe to block.
4096-8191, # VPN, games, P2P, WebRTC, VoIP of some clients.
# Can block, but cautiously: may affect VPN/apps.
8192-12287, # QUIC/HTTP3, proxies, multimedia protocols.
# Might cause side effects; better test first.
12288-16383, # Old RTP/VoIP ranges and media streams.
# Can block, but might break video calls.
16384-24575, # Main RTP range (audio/video), WebRTC, VoIP.
# ❗ Do not block if you need video calls/WebRTC/VPN.
24576-32767 # Dynamic ports for VPN, P2P, games, streaming data.
# ❗ May break VPN or some apps.
} drop

# == 🕷️ Blocking suspicious IPs —
# large ranges often used by botnets, spam networks, and scanners ==
ip saddr {
185.0.0.0/8, # Abused hosting and proxy networks.
37.0.0.0/8, # Cheap VPS, scanning sources.
88.0.0.0/8, # Frequent brute-force and scanners.
77.0.0.0/8, # Massive TOR/proxy nodes.
91.0.0.0/8 # Botnets and “grey” hosting.
} drop
}
}

</syntaxhighlight>

====== sysctl config: ======
kernel parameters configuration

/etc/sysctl.d/99-protect.conf<syntaxhighlight lang="bash">
# 1 Ignore ICMP on interfaces
net.ipv4.icmp_echo_ignore_all = 1

# 2 Do not respond to ICMP broadcast (against Smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 3 Enable SYN backlog reduction
net.ipv4.tcp_syncookies = 1

# 4 Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 5 Log packets with incorrect routing
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# 6 Disable ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# 7 Disable packet forwarding
net.ipv4.ip_forward = 0

# 8 Disable IPv6 support
net.ipv4.conf.all.disable_ipv6 = 1
net.ipv4.conf.default.disable_ipv6 = 1

# 9 Prevent sending TCP segments with null windows
net.ipv4.tcp_rfc1337 = 1

# 10 Disable ARP filtering for automatic routing
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1

# 11 Limit the maximum size of the incoming TCP window
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# 12 Drop packets with incorrect checksums
net.ipv4.conf.all.drop_unicast_in_l2_multicast = 1
net.ipv4.conf.default.drop_unicast_in_l2_multicast = 1

# 13 Disable IPv6 forwarding
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# 14 Limit the maximum number of SYN packet retries
net.ipv4.tcp_synack_retries = 2

# 15 Increase routing cache lifetime
net.ipv4.route.max_size = 32768
</syntaxhighlight>

====== auditd rules config: ======
/etc/audit/rules.d/audit.rules

<syntaxhighlight lang="bash">
## Flush rules
-D

## Buffers
-b 8192
--backlog_wait_time 60000
-f 1

## Network audit
-a always,exit -F arch=b64 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b64 -S accept4 -F success=1 -k network_accept
-a always,exit -F arch=b32 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b32 -S accept4 -F success=1 -k network_accept

## Logging execve commands
-a always,exit -F arch=b64 -S execve -F key=exec_log

## Audit logins and sessions
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session

## sudo / su
-w /etc/sudoers -p wa -k sudo
-w /etc/sudoers.d/ -p wa -k sudo
-w /bin/su -p x -k su_cmd

## Account and configuration changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/hosts -p wa -k system_conf
-w /etc/hostname -p wa -k system_conf
-w /etc/resolv.conf -p wa -k system_conf
-w /etc/issue -p wa -k system_conf
-w /etc/network/ -p wa -k system_conf

## Time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -F key=time_change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -F key=time_change

## Audit SSH connections and changes
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /var/log/auth.log -p wa -k ssh_login

## Audit usage of remote tools (e.g., SSH, netcat)
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/nc -k nc_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/nc -k nc_process

## Audit privileged access
-a always,exit -F arch=b64 -S setuid -S setgid -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -S setgid -k privilege_escalation
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/sudoers.d/ -p wa -k sudoers_changes
-w /bin/sudo -p x -k sudo_command

## Monitor credential changes
#-w /root/.ssh/ -p wa -k ssh_keys
#-w /home/*/.ssh/ -p wa -k ssh_keys

## Audit use of remote network services
-a always,exit -F arch=b64 -S socket -F success=1 -k socket_connect
-a always,exit -F arch=b32 -S socket -F success=1 -k socket_connect

# Log package installation and removal via dpkg
-w /usr/bin/dpkg -p x
-w /usr/sbin/apt-get -p x
-w /usr/bin/apt -p x
</syntaxhighlight>

==== UsefulPrograms ====

Here is the list of programs useful for configuring and maintaining the security of Linux systems. The included programs are either open-source (the majority) or commercial, but with freely available limited features sufficient to address core security tasks (a smaller portion).

https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/UsefulPrograms

==== External Resources ====

[https://www.debian.org/doc/manuals/securing-debian-manual/index.en.html|Securing Debian Manual 3.19 — Javier Fernández-Sanguino Peña.]
This document describes security in the Debian project and in the Debian operating system. Starting with the process of securing and hardening the default Debian GNU/Linux distribution installation, it also covers some of the common tasks to set up a secure network environment using Debian GNU/Linux, gives additional information on the security tools available and talks about how security is enforced in Debian by the security and audit team.

[https://medium.com/%40ihouelecaurcy/the-complete-nftables-guide-modern-linux-firewall-mastery-79fb86894d5c|The Complete nftables Guide: Modern Linux Firewall Mastery — Ihouele Caurcy]
The definitive guide to nftables — the modern replacement for iptables, ip6tables, arptables, and ebtables. From basic concepts to enterprise-level configurations.

[https://notes.suhaib.in/docs/tech/utilities/iptables-nftables-and-you-a-friendly-guide-to-traffic-rules/|iptables, nftables, and You A Friendly Guide to Traffic Rules]
A friendly guide to iptables and nftables in Linux: explains Netfilter architecture, tables, chains and rules, with configuration examples (SSH, IP blocking, port forwarding). Covers differences between iptables and nftables, migration, and compatibility with modern firewall tools. Useful for understanding the iptables→nftables transition and practical examples.

[https://public.jdstone1.com/books_and_magazines/Computer_Books/Operating_Systems/SELinux%20System%20Administration%20(3rd%20ed).pdf|SELinux System Administration Third Edition — Sven Vermeulen.]
Implement mandatory access control to secure applications, users, and information flows on Linux.

[https://gitlab.com/apparmor/apparmor/-/wikis/home AppArmor]
The official wiki for the AppArmor security project on Linux. Provides guidance for users and developers, instructions for creating and managing security profiles, example access policies for applications, and best practices to protect the operating system.

[https://nallino.net/stockage/security/Linux_Mint_Security.pdf|Security, Privacy and Anonymity in Linux Mint — Michel Nallino.]
A good and comprehensive work on Linux Mint security that can also be useful for other Linux distributions.

[https://www.cisa.gov/topics/cybersecurity-best-practices|CISA — Cybersecurity Best Practices]
CISA (Certified Information Systems Auditor) provides information on cybersecurity best practices to help individuals and organizations implement preventative measures and manage cyber risks.

==== Provenance ====

This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131

it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks

[[index.php?title=Category:Security]]
[[index.php?title=Category:Hardening]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2025-12-16T17:56:30Z

Blackcat568: /* Countermeasures */

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.

* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

''Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build).''

Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

# 1. Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.
# If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to type long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>
# Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.
# Avoid using the superuser account or sudo without a clear necessity — and never execute arbitrary scripts with sudo. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
## Always read a script fully before running it (less script.sh, cat script.sh).
## Never paste commands from untrusted or unverified sources into the terminal.
## Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
## Follow the principle of least privilege — create separate user accounts and limit access rights where possible Important: Improper or careless use of sudo and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.
# Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. You may also consider switching to SELinux. If you have difficulty configuring AppArmor or SELinux, seek help from specialists or use AI-based tools. My SELinux configuration is attached below (I use SELinux on Debian 12 — it works reliably).
# Use advanced network filtering settings: iptables or nftables, or a commercial firewall. (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#nftables config:|nftables config]]
# Configure kernel parameters for maximum security (sysctl hardening). (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#sysctl config:|sysctl config]])
# Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event). (sample [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#auditd rules config:|auditd rules config]]
# Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.
# If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.
# Follow the principle of Attack Surface Reduction (or [https://en.wikipedia.org/wiki/Occam's_razor Occam's Razor]) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
## If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
## If you are certain you will never use it, remove it completely from the system.
## This practice reduces potential attack vectors and strengthens overall system security.
## Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications. Always create a full system backup before making any significant configuration changes or modifications.
# Perform regular antivirus and anti-rootkit scans of the system. In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.
# Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:
<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

'''Related Aspects of Internet Security'''

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

1. Store passwords in a reliable password manager.

'''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:

* relying on human memory, with the risk of forgetting or confusing credentials;
* storing passwords on paper media, which can be damaged, lost, or stolen;
* saving passwords in web browsers in unencrypted form;
* keeping passwords in plain text files on the desktop or in other directories without encryption;
* and similar approaches.

Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.

A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.

* Regularly create up-to-date backups of the ''encrypted'' password database.

* Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.

Additional Practical Recommendations

A password manager (for example, KeePassXC) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.

In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.

It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).

2. Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [[wikipedia:Authenticator_app|Authenticator_app]]), or a hardware security key such as a [[wikipedia:YubiKey|YubiKey]].

This is a critical cybersecurity measure — neglecting it can completely undermine all your efforts in configuring a secure Linux system.

The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:

* YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
* It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
* Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number. For now, it is one of the most reliable hardware-based options for two-factor authentication.

3. Using VPN to improve privacy and security

''If you are a private user'', you can also configure a system-wide VPN (for example, ProtonVPN) so that all device traffic is routed through it — not only browser traffic or traffic from specific applications.

Enable the “killswitch” mode and disable it only when necessary, re-enabling it immediately afterwards.

It is also recommended to periodically change VPN servers, doing so at different and unpredictable intervals.

Using a VPN increases your privacy: all of your traffic will be encrypted from observers on your local network and from your internet service provider. This makes it more difficult for an attacker to apply certain social-engineering methods based on traffic analysis, and it also helps protect your privacy in the event that your provider’s infrastructure is compromised.

''If you own a server'' and want access to it to be available only to trusted private or legal entities, while also increasing its protection against unauthorized access, you can configure the server so that SSH and other internal services are accessible exclusively through OpenVPN using TLS authentication (tls-auth / tls-crypt) and unique client certificates instead of passwords.

4. Actively study and apply artificial intelligence to improve security configurations in Debian and other Linux distributions, as well as to address related cybersecurity tasks. A lack of knowledge often becomes the weakest link; AI can provide accurate, structured recommendations interactively and help automate repetitive or complex operations.

5. If privacy is a priority, consider reducing reliance on the Google ecosystem and switching to more privacy-focused alternatives (for example, proton.me and similar services). Google provides very strong security, but its services collect extensive telemetry for analysis. While this data is encrypted and not accessible to attackers, it may still be undesirable for users who value strict privacy.

''Always verify AI-generated recommendations before applying them in production environments. Test any changes in an isolated system, review generated commands or configurations, and ensure that suggestions align with your threat model and security architecture.''

''In practice, users who effectively leverage AI tools are significantly better prepared, and the adoption of such technologies makes malicious activity considerably more difficult for attackers.''

'''''Note:''' Artificial intelligence tools are mentioned here as optional technical aids, not as an endorsement of any specific service or vendor.''

6. It is also important to consider the possibility of hardware-level attacks.

Although such attacks are significantly less common and typically require more resources than software-based attacks, they remain a potential threat. In certain scenarios, an adversary may exploit vulnerabilities in device firmware or conduct a combined attack targeting both software and hardware layers. Examples include remote injection of malicious code into the firmware of a motherboard, router, optical modem, or other hardware components.

If, after a thorough software-level audit, a security issue remains unresolved, it is advisable <nowiki>'''</nowiki>to perform a hardware-level assessment<nowiki>'''</nowiki> as well, including verification of device firmware integrity and configuration.

<blockquote>'''And most importantly — give up the illusion of complete security. We live in conditions of a severe information war, and everyone must make efforts so that malicious actors cannot freely spy on desktops and servers.'''</blockquote>

'''Examples of Deep Custom Security Configurations'''

Below are examples of strong, individualized configurations for '''SELinux''', '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

====== SELinux config: ======
<syntaxhighlight lang="terminfo">
root@user:/home/user# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
root@user:/home/user# sestatus -v
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

Process contexts:
Current context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Init context: system_u:system_r:init_t:s0
/sbin/agetty system_u:system_r:getty_t:s0

File contexts:
Controlling terminal: unconfined_u:object_r:user_devpts_t:s0
/etc/passwd system_u:object_r:etc_t:s0
/etc/shadow system_u:object_r:unlabeled_t:s0
/bin/bash system_u:object_r:shell_exec_t:s0
/bin/login system_u:object_r:login_exec_t:s0
/bin/sh system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0
/sbin/agetty system_u:object_r:getty_exec_t:s0
/sbin/init system_u:object_r:bin_t:s0 -> system_u:object_r:init_exec_t:s0
/lib/ld-linux.so.2 system_u:object_r:lib_t:s0 -> system_u:object_r:ld_so_t:s0
</syntaxhighlight>

====== nftables config: ======
<syntaxhighlight lang="bash">
#!/usr/sbin/nft -f

flush ruleset

table inet filter {

# = Main chain policy =
chain input {
type filter hook input priority 0;
policy drop;

# = Common rule set =
# 🌀 Allow loopback interface (internal system processes)
iif "lo" accept

# == 🔁 Allow established and related connections ==
ct state established,related accept

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# == 🔒 Limit the rate of NEW connections per source IP (basic anti-DDoS protection) ==
# If you experience issues with slow or failed page loads in your browser,
# try increasing the limit, for example:
# ip saddr 0.0.0.0/0 ct state new limit rate 50/second burst 100 packets accept
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == 🚫 Blocking SSDP and mDNS (local broadcast discovery protocols) ==
ip daddr 239.255.255.250 udp dport 1900 drop # ❌ SSDP (UPnP/device discovery)
ip daddr 224.0.0.251 udp dport 5353 drop # ❌ mDNS (Bonjour, Avahi)

# == 🛑 Blocking NetBIOS and LLMNR (Windows/systemd internal LAN protocols) ==
udp dport 137 drop # ❌ NetBIOS Name Service (Windows network names)
udp dport 138 drop # ❌ NetBIOS Datagram Service (LAN name discovery)
udp dport 5355 drop # ❌ LLMNR (Link-Local Multicast Name Resolution)

# = Set of blocked IP addresses and ranges =

# == 🧱 Blocking known botnets and proxy networks ==
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} log prefix "🔥 BAN: known bots " flags all
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} drop

# == 🚫 Blocking strange TCP flags (XMAS, NULL scans and others) ==
tcp flags & (fin|syn|rst|psh|ack|urg) == 0 drop # NULL scan
tcp flags & (fin|psh|urg) == (fin|psh|urg) drop # XMAS scan
tcp flags & (fin|syn) == (fin|syn) drop # SYN-ACK scan
tcp flags & (syn|rst|fin) == (syn|rst|fin) drop # Xmas scan
tcp flags & (syn|fin|rst|psh|ack) == (syn|rst|fin|ack) drop # Xmas scan

# == 🚫 Blocking fragmented packets — commonly used in filter evasion ==
ip frag-off & 0x1fff != 0 drop

# == 🔒 Blocking spoofed IP packets ==
ip saddr 127.0.0.0/8 drop # localhost
ip saddr 10.0.0.0/8 drop # private network
ip saddr 172.16.0.0/12 drop # private network
ip saddr 192.168.0.0/16 drop # private network
ip saddr 169.254.0.0/16 drop # APIPA
ip saddr 0.0.0.0/8 drop # invalid address
ip saddr 224.0.0.0/4 drop # multicast
ip saddr 240.0.0.0/5 drop # reserved
}

# = Main chain policy =
chain forward {
type filter hook forward priority 0;
policy accept;

# = Blocking various types of attacks =
# Required in chain forward only if Docker or Oracle VirtualBox is present.
# If needed — uncomment.

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
# ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
# ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
# ip protocol icmp icmp type echo-request limit rate 1/second accept
# ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
# ip protocol icmp icmp type echo-request drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports required for application operation ==
tcp dport {
53, # DNS — needed for domain name resolution
80, # HTTP — web traffic, updates and resource loading
443, # HTTPS — secure web traffic, VPN, browser
12043, # Custom 3D Application — specific client port
13000-13050 # Custom 3D Application — dynamic client port range
} accept

# == Allow UDP ports required for application operation ==
udp dport {
53, # DNS — needed for domain name resolution
443, # HTTPS via QUIC/HTTP3, browser protocols
3478, # STUN/TURN — WebRTC and video calls
3479-3481 # STUN/TURN — WebRTC and video calls
} accept

# = Blocking dangerous and unnecessary TCP/UDP ports and ranges =

# These blocklists are intended for a DESKTOP / workstation.
# They block remote access, outdated services, proxies, DBs, IoT, and ports
# often used by malware, scanners, and C2 infrastructures.
#
# ⚠ If you use the system as a SERVER, enable IP forwarding,
# or run services with internal routing
# (Docker NAT/bridge, VirtualBox host-only/bridged, VPN clients),
# carefully review the blocked ports/ranges in the forward chain —
# these services may need extra ports.
# Adjust or comment out required items if necessary.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high risk) ===
22, # SSH — common brute-force target
23, # Telnet — outdated, no encryption
3389, # RDP — Windows remote desktop
5900, # VNC — remote access, frequent vulnerabilities
# === FTP / SMB / NetBIOS (unsafe file-sharing protocols) ===
21, # FTP — insecure protocol
137, # NetBIOS Name Service
138, # NetBIOS Datagram
139, # NetBIOS Session
445, # SMB/CIFS — common exploit target
# === Databases (NEVER expose to the Internet) ===
3306, # MySQL/MariaDB
1433, # MS SQL Server
1434, # MS SQL Browser
# === HTTP-alt/Proxy/Elasticsearch (exploited frequently) ===
8080, # HTTP proxy / web interfaces — often exposed accidentally
9200, # Elasticsearch API — full remote data access
# === UPnP/IoT (insecure by design) ===
1900, # SSDP / UPnP
# === Common for malware (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell
5555, # Android ADB / IoT botnets
9001, # Tor transport (used by malware)
1234, # Netcat / reverse connections
1337, # Common C2 port used by malware
# === ⚠️ Scanner ports and potentially vulnerable services ===
1080, # SOCKS proxy — used to bypass filtering
3128, # Squid proxy — may be abused as open proxy
8000, # Alternative HTTP ports, dev servers
8888, # Web interfaces, proxies, dev tools
10000 # Webmin — remote admin panel, frequent attacks
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; abused by attackers
162 # SNMP Trap — also potentially vulnerable
} drop

# Attention! Blocking wide port ranges — be careful!
# Do not break system or application functionality!

# == TCP port ranges not used by a workstation during transit routing ==
# Blocked to prevent unwanted forwarding, hidden tunnels,
# NAT evasion, parasitic flows, and potential forward-path attacks.

tcp dport {
1024-2047, # System/legacy services; rarely needed in forward
2048-4095, # Proprietary daemons; NFS (2049) — check if used
4096-8191, # Old VPNs, some games, P2P; rarely needed on desktop
8192-12287, # Alternative HTTP/proxy, multimedia; test as needed
12288-16383, # Media/VoIP (TCP fallback); may break calls
16384-24575, # RTP/WebRTC (TCP fallback); block unless AV needed
24576-32767, # Dynamic ranges for games/VPN; may cause issues
32768-49151, # Registered/ephemeral; risky — may break NAT, Docker, VM
49152-65535 # High ephemeral; widely used by modern apps
} drop

# == 🚫 Blocking UDP ports — high and dynamic ranges ==
udp dport {
1024-9999, # low/mid ephemeral ports; used by trojans, P2P, games, VPN
10000-65535 # high ephemeral; used by dynamic apps, VPN, Docker
} drop

# = 🕷️ Suspicious IPs — large ranges often used by botnets, spam nets, and scanners =
ip saddr {
185.0.0.0/8, # abused hosting and proxy networks
37.0.0.0/8, # cheap VPS, frequent scanning sources
88.0.0.0/8, # common brute-force and scanner range
77.0.0.0/8, # TOR/proxy nodes
91.0.0.0/8 # botnets and “grey-zone” hosting
} drop
}

chain output {
# = Main chain policy =
type filter hook output priority 0;
policy accept;

# = Blocking various types of attacks =

# == 🔒 Limiting new connections from a single IP (anti-DDoS) ==
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# = ICMP protocol restrictions =

# == 🛡️ Ping limitation ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == Critically important ICMP for network ==
ip protocol icmp icmp type { destination-unreachable, time-exceeded, parameter-problem } accept

# == Important ICMPv6 for IPv6 ==
ip6 nexthdr icmpv6 icmpv6 type { 1, 2, 3, 4 } accept
ip6 nexthdr icmpv6 icmpv6 type { 135, 136 } accept # NS/NA
ip6 nexthdr icmpv6 icmpv6 type { 133, 134 } accept # RS/RA

# == Drop all other ICMP and ICMPv6 ==
ip protocol icmp drop # drop all other ICMP
ip6 nexthdr icmpv6 drop # drop all other ICMPv6

# = SCTP protocol blocking =
# 99.9% of desktop systems do not use SCTP at all
meta l4proto sctp drop

# = DCCP — Datagram Congestion Control Protocol blocking =
# Not used by any mainstream desktop applications
meta l4proto dccp drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports and ranges required for application functionality ==
tcp dport {
53, # DNS client. Required for Internet to work: domain name resolution (UDP/TCP).
80, # HTTP traffic to unencrypted websites; apps may use it for API/redirects.
443, # HTTPS. Main port for all encrypted web traffic — browsers, API, VPN, updates.
3306, # MySQL client. Needed if you connect to MySQL.
3478, # STUN/TURN WebRTC. Needed for audio/video/Discord.
3000, # Node.js dev servers. Needed for development.
3690, # SVN. If you work with an old repository.
4443, # Alternative HTTPS (some APIs). Also used by some VPN/clients.
12043, # Required for Custom 3D Application.
13000-13050 # Required for Custom 3D Application.
} accept

# == Allow UDP ports and ranges required for applications ==
udp dport {
443, # Required for fast and stable operation of modern websites
# (Google, YouTube, ChatGPT, Cloudflare)
13000-13050 # Required for Custom 3D Application.
} accept

# = Blocking potentially dangerous / unnecessary TCP/UDP ports =

# These blocks are intended for a DESKTOP / workstation.
# ⚠ If you use the system as a SERVER —
# adjust or comment out the required ports/ranges as needed.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high-risk) ===
22, # SSH — target of brute-force attacks.
23, # Telnet — outdated, unencrypted.
3389, # RDP — Windows remote access.
5900, # VNC — remote access, often vulnerable.
# === FTP / SMB / NetBIOS (dangerous file-sharing services) ===
21, # FTP — insecure protocol.
137, # NetBIOS Name Service.
138, # NetBIOS Datagram.
139, # NetBIOS Session.
445, # SMB/CIFS — frequent exploitation target.
# === Databases (NEVER open to the Internet) ===
3306, # MySQL/MariaDB.
1433, # MS SQL Server.
1434, # MS SQL Browser.
# === HTTP-alt/Proxy/Elasticsearch (dangerous, often attacked) ===
8080, # HTTP proxy / web interfaces — often exposed test interfaces.
9200, # Elasticsearch API — full remote access to data.
# === UPnP/IoT (vulnerable by design) ===
1900, # SSDP / UPnP.
# === Common malware ports (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell.
5555, # Android ADB / IoT botnets.
9001, # Tor transport (used by malware).
1234, # Netcat / reverse connections.
1337, # Common C2 malware port.
# === ⚠️ Ports of scanners and potentially vulnerable services ===
1080, # SOCKS proxy — often abused for bypassing filters.
3128, # Squid HTTP proxy — can be used as open proxy.
8000, # Alternative HTTP ports, web services — potentially vulnerable.
8888, # Alternative web interfaces — test and proxy ports.
10000 # Webmin — web admin panel, target of attacks.
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; can be abused by attackers.
162 # SNMP Trap — same, potential vulnerability.
} drop

# Warning! ⚠️ Be careful blocking wide port ranges! ⚠️
# Do not break system or application functionality!
# If you need a range — uncomment.
# If you don’t — comment out.

# == Blocking “dangerous” and desktop-unnecessary TCP port ranges ==
tcp dport {
1-1023, # 🛑 Privileged ports.
1024-2047, # r-commands (rlogin, rsh, rexec), old RPC, NFS, legacy daemons.
2048-3071, # Rare proprietary protocols and middleware.
3072-4999, # Mostly ports of legacy, server, corporate apps;
# rarely needed on workstations.
5000-5999, # Alternative services, old P2P/admin ports, rarely used on desktops.
7000-7999, # Alternative/test ports, often used by trojans.
9000-9999, # Web services, proxies, possible backdoor ports.
10000-19998, # Dynamic/high service ports; may be required by some apps like Custom 3D Application,
# but not needed by most desktop services.
19999-32767 # Old ephemeral port range; used by P2P, games, some VPNs,
# but system services rarely use them.
} drop

# == Blocking “dangerous” and desktop-unnecessary UDP port ranges ==
udp dport {
1024-2047, # Old UNIX services, RPC, NFS, r-commands, legacy daemons.
# Usually safe to block.
2048-4095, # Rarely used standard ports, proprietary services.
# Usually safe to block.
4096-8191, # VPN, games, P2P, WebRTC, VoIP of some clients.
# Can block, but cautiously: may affect VPN/apps.
8192-12287, # QUIC/HTTP3, proxies, multimedia protocols.
# Might cause side effects; better test first.
12288-16383, # Old RTP/VoIP ranges and media streams.
# Can block, but might break video calls.
16384-24575, # Main RTP range (audio/video), WebRTC, VoIP.
# ❗ Do not block if you need video calls/WebRTC/VPN.
24576-32767 # Dynamic ports for VPN, P2P, games, streaming data.
# ❗ May break VPN or some apps.
} drop

# == 🕷️ Blocking suspicious IPs —
# large ranges often used by botnets, spam networks, and scanners ==
ip saddr {
185.0.0.0/8, # Abused hosting and proxy networks.
37.0.0.0/8, # Cheap VPS, scanning sources.
88.0.0.0/8, # Frequent brute-force and scanners.
77.0.0.0/8, # Massive TOR/proxy nodes.
91.0.0.0/8 # Botnets and “grey” hosting.
} drop
}
}

</syntaxhighlight>

====== sysctl config: ======
kernel parameters configuration

/etc/sysctl.d/99-protect.conf<syntaxhighlight lang="bash">
# 1 Ignore ICMP on interfaces
net.ipv4.icmp_echo_ignore_all = 1

# 2 Do not respond to ICMP broadcast (against Smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 3 Enable SYN backlog reduction
net.ipv4.tcp_syncookies = 1

# 4 Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 5 Log packets with incorrect routing
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# 6 Disable ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# 7 Disable packet forwarding
net.ipv4.ip_forward = 0

# 8 Disable IPv6 support
net.ipv4.conf.all.disable_ipv6 = 1
net.ipv4.conf.default.disable_ipv6 = 1

# 9 Prevent sending TCP segments with null windows
net.ipv4.tcp_rfc1337 = 1

# 10 Disable ARP filtering for automatic routing
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1

# 11 Limit the maximum size of the incoming TCP window
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# 12 Drop packets with incorrect checksums
net.ipv4.conf.all.drop_unicast_in_l2_multicast = 1
net.ipv4.conf.default.drop_unicast_in_l2_multicast = 1

# 13 Disable IPv6 forwarding
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# 14 Limit the maximum number of SYN packet retries
net.ipv4.tcp_synack_retries = 2

# 15 Increase routing cache lifetime
net.ipv4.route.max_size = 32768
</syntaxhighlight>

====== auditd rules config: ======
/etc/audit/rules.d/audit.rules

<syntaxhighlight lang="bash">
## Flush rules
-D

## Buffers
-b 8192
--backlog_wait_time 60000
-f 1

## Network audit
-a always,exit -F arch=b64 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b64 -S accept4 -F success=1 -k network_accept
-a always,exit -F arch=b32 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b32 -S accept4 -F success=1 -k network_accept

## Logging execve commands
-a always,exit -F arch=b64 -S execve -F key=exec_log

## Audit logins and sessions
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session

## sudo / su
-w /etc/sudoers -p wa -k sudo
-w /etc/sudoers.d/ -p wa -k sudo
-w /bin/su -p x -k su_cmd

## Account and configuration changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/hosts -p wa -k system_conf
-w /etc/hostname -p wa -k system_conf
-w /etc/resolv.conf -p wa -k system_conf
-w /etc/issue -p wa -k system_conf
-w /etc/network/ -p wa -k system_conf

## Time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -F key=time_change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -F key=time_change

## Audit SSH connections and changes
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /var/log/auth.log -p wa -k ssh_login

## Audit usage of remote tools (e.g., SSH, netcat)
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/nc -k nc_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/nc -k nc_process

## Audit privileged access
-a always,exit -F arch=b64 -S setuid -S setgid -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -S setgid -k privilege_escalation
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/sudoers.d/ -p wa -k sudoers_changes
-w /bin/sudo -p x -k sudo_command

## Monitor credential changes
#-w /root/.ssh/ -p wa -k ssh_keys
#-w /home/*/.ssh/ -p wa -k ssh_keys

## Audit use of remote network services
-a always,exit -F arch=b64 -S socket -F success=1 -k socket_connect
-a always,exit -F arch=b32 -S socket -F success=1 -k socket_connect

# Log package installation and removal via dpkg
-w /usr/bin/dpkg -p x
-w /usr/sbin/apt-get -p x
-w /usr/bin/apt -p x
</syntaxhighlight>

==== UsefulPrograms ====

Here is the list of programs useful for configuring and maintaining the security of Linux systems. The included programs are either open-source (the majority) or commercial, but with freely available limited features sufficient to address core security tasks (a smaller portion).

https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/UsefulPrograms

==== External Resources ====

[https://www.debian.org/doc/manuals/securing-debian-manual/index.en.html|Securing Debian Manual 3.19 — Javier Fernández-Sanguino Peña.]
This document describes security in the Debian project and in the Debian operating system. Starting with the process of securing and hardening the default Debian GNU/Linux distribution installation, it also covers some of the common tasks to set up a secure network environment using Debian GNU/Linux, gives additional information on the security tools available and talks about how security is enforced in Debian by the security and audit team.

[https://medium.com/%40ihouelecaurcy/the-complete-nftables-guide-modern-linux-firewall-mastery-79fb86894d5c|The Complete nftables Guide: Modern Linux Firewall Mastery — Ihouele Caurcy]
The definitive guide to nftables — the modern replacement for iptables, ip6tables, arptables, and ebtables. From basic concepts to enterprise-level configurations.

[https://notes.suhaib.in/docs/tech/utilities/iptables-nftables-and-you-a-friendly-guide-to-traffic-rules/|iptables, nftables, and You A Friendly Guide to Traffic Rules]
A friendly guide to iptables and nftables in Linux: explains Netfilter architecture, tables, chains and rules, with configuration examples (SSH, IP blocking, port forwarding). Covers differences between iptables and nftables, migration, and compatibility with modern firewall tools. Useful for understanding the iptables→nftables transition and practical examples.

[https://public.jdstone1.com/books_and_magazines/Computer_Books/Operating_Systems/SELinux%20System%20Administration%20(3rd%20ed).pdf|SELinux System Administration Third Edition — Sven Vermeulen.]
Implement mandatory access control to secure applications, users, and information flows on Linux.

[https://gitlab.com/apparmor/apparmor/-/wikis/home AppArmor]
The official wiki for the AppArmor security project on Linux. Provides guidance for users and developers, instructions for creating and managing security profiles, example access policies for applications, and best practices to protect the operating system.

[https://nallino.net/stockage/security/Linux_Mint_Security.pdf|Security, Privacy and Anonymity in Linux Mint — Michel Nallino.]
A good and comprehensive work on Linux Mint security that can also be useful for other Linux distributions.

[https://www.cisa.gov/topics/cybersecurity-best-practices|CISA — Cybersecurity Best Practices]
CISA (Certified Information Systems Auditor) provides information on cybersecurity best practices to help individuals and organizations implement preventative measures and manage cyber risks.

==== Provenance ====

This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131

it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks

[[index.php?title=Category:Security]]
[[index.php?title=Category:Hardening]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2025-12-16T17:52:50Z

Blackcat568: /* Source */

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.

* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

===== Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build). =====
Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

# 1. Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.
# If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to type long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>
# Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.
# Avoid using the superuser account or sudo without a clear necessity — and never execute arbitrary scripts with sudo. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
## Always read a script fully before running it (less script.sh, cat script.sh).
## Never paste commands from untrusted or unverified sources into the terminal.
## Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
## Follow the principle of least privilege — create separate user accounts and limit access rights where possible Important: Improper or careless use of sudo and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.
# Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. You may also consider switching to SELinux. If you have difficulty configuring AppArmor or SELinux, seek help from specialists or use AI-based tools. My SELinux configuration is attached below (I use SELinux on Debian 12 — it works reliably).
# Use advanced network filtering settings: iptables or nftables, or a commercial firewall. (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#nftables config:|nftables config]]
# Configure kernel parameters for maximum security (sysctl hardening). (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#sysctl config:|sysctl config]])
# Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event). (sample [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#auditd rules config:|auditd rules config]]
# Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.
# If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.
# Follow the principle of Attack Surface Reduction (or [https://en.wikipedia.org/wiki/Occam's_razor Occam's Razor]) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
## If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
## If you are certain you will never use it, remove it completely from the system.
## This practice reduces potential attack vectors and strengthens overall system security.
## Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications. Always create a full system backup before making any significant configuration changes or modifications.
# Perform regular antivirus and anti-rootkit scans of the system. In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.
# Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:
<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

'''Related Aspects of Internet Security'''

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

1. Store passwords in a reliable password manager.

'''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:

* relying on human memory, with the risk of forgetting or confusing credentials;
* storing passwords on paper media, which can be damaged, lost, or stolen;
* saving passwords in web browsers in unencrypted form;
* keeping passwords in plain text files on the desktop or in other directories without encryption;
* and similar approaches.

Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.

A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.

* Regularly create up-to-date backups of the ''encrypted'' password database.

* Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.

Additional Practical Recommendations

A password manager (for example, KeePassXC) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.

In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.

It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).

2. Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [[wikipedia:Authenticator_app|Authenticator_app]]), or a hardware security key such as a [[wikipedia:YubiKey|YubiKey]].

This is a critical cybersecurity measure — neglecting it can completely undermine all your efforts in configuring a secure Linux system.

The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:

* YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
* It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
* Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number. For now, it is one of the most reliable hardware-based options for two-factor authentication.

3. Using VPN to improve privacy and security

''If you are a private user'', you can also configure a system-wide VPN (for example, ProtonVPN) so that all device traffic is routed through it — not only browser traffic or traffic from specific applications.

Enable the “killswitch” mode and disable it only when necessary, re-enabling it immediately afterwards.

It is also recommended to periodically change VPN servers, doing so at different and unpredictable intervals.

Using a VPN increases your privacy: all of your traffic will be encrypted from observers on your local network and from your internet service provider. This makes it more difficult for an attacker to apply certain social-engineering methods based on traffic analysis, and it also helps protect your privacy in the event that your provider’s infrastructure is compromised.

''If you own a server'' and want access to it to be available only to trusted private or legal entities, while also increasing its protection against unauthorized access, you can configure the server so that SSH and other internal services are accessible exclusively through OpenVPN using TLS authentication (tls-auth / tls-crypt) and unique client certificates instead of passwords.

4. Actively study and apply artificial intelligence to improve security configurations in Debian and other Linux distributions, as well as to address related cybersecurity tasks. A lack of knowledge often becomes the weakest link; AI can provide accurate, structured recommendations interactively and help automate repetitive or complex operations.

5. If privacy is a priority, consider reducing reliance on the Google ecosystem and switching to more privacy-focused alternatives (for example, proton.me and similar services). Google provides very strong security, but its services collect extensive telemetry for analysis. While this data is encrypted and not accessible to attackers, it may still be undesirable for users who value strict privacy.

''Always verify AI-generated recommendations before applying them in production environments. Test any changes in an isolated system, review generated commands or configurations, and ensure that suggestions align with your threat model and security architecture.''

''In practice, users who effectively leverage AI tools are significantly better prepared, and the adoption of such technologies makes malicious activity considerably more difficult for attackers.''

'''''Note:''' Artificial intelligence tools are mentioned here as optional technical aids, not as an endorsement of any specific service or vendor.''

6. It is also important to consider the possibility of hardware-level attacks.

Although such attacks are significantly less common and typically require more resources than software-based attacks, they remain a potential threat. In certain scenarios, an adversary may exploit vulnerabilities in device firmware or conduct a combined attack targeting both software and hardware layers. Examples include remote injection of malicious code into the firmware of a motherboard, router, optical modem, or other hardware components.

If, after a thorough software-level audit, a security issue remains unresolved, it is advisable <nowiki>'''</nowiki>to perform a hardware-level assessment<nowiki>'''</nowiki> as well, including verification of device firmware integrity and configuration.

<blockquote>'''And most importantly — give up the illusion of complete security. We live in conditions of a severe information war, and everyone must make efforts so that malicious actors cannot freely spy on desktops and servers.'''</blockquote>

'''Examples of Deep Custom Security Configurations'''

Below are examples of strong, individualized configurations for '''SELinux''', '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

====== SELinux config: ======
<syntaxhighlight lang="terminfo">
root@user:/home/user# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
root@user:/home/user# sestatus -v
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

Process contexts:
Current context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Init context: system_u:system_r:init_t:s0
/sbin/agetty system_u:system_r:getty_t:s0

File contexts:
Controlling terminal: unconfined_u:object_r:user_devpts_t:s0
/etc/passwd system_u:object_r:etc_t:s0
/etc/shadow system_u:object_r:unlabeled_t:s0
/bin/bash system_u:object_r:shell_exec_t:s0
/bin/login system_u:object_r:login_exec_t:s0
/bin/sh system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0
/sbin/agetty system_u:object_r:getty_exec_t:s0
/sbin/init system_u:object_r:bin_t:s0 -> system_u:object_r:init_exec_t:s0
/lib/ld-linux.so.2 system_u:object_r:lib_t:s0 -> system_u:object_r:ld_so_t:s0
</syntaxhighlight>

====== nftables config: ======
<syntaxhighlight lang="bash">
#!/usr/sbin/nft -f

flush ruleset

table inet filter {

# = Main chain policy =
chain input {
type filter hook input priority 0;
policy drop;

# = Common rule set =
# 🌀 Allow loopback interface (internal system processes)
iif "lo" accept

# == 🔁 Allow established and related connections ==
ct state established,related accept

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# == 🔒 Limit the rate of NEW connections per source IP (basic anti-DDoS protection) ==
# If you experience issues with slow or failed page loads in your browser,
# try increasing the limit, for example:
# ip saddr 0.0.0.0/0 ct state new limit rate 50/second burst 100 packets accept
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == 🚫 Blocking SSDP and mDNS (local broadcast discovery protocols) ==
ip daddr 239.255.255.250 udp dport 1900 drop # ❌ SSDP (UPnP/device discovery)
ip daddr 224.0.0.251 udp dport 5353 drop # ❌ mDNS (Bonjour, Avahi)

# == 🛑 Blocking NetBIOS and LLMNR (Windows/systemd internal LAN protocols) ==
udp dport 137 drop # ❌ NetBIOS Name Service (Windows network names)
udp dport 138 drop # ❌ NetBIOS Datagram Service (LAN name discovery)
udp dport 5355 drop # ❌ LLMNR (Link-Local Multicast Name Resolution)

# = Set of blocked IP addresses and ranges =

# == 🧱 Blocking known botnets and proxy networks ==
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} log prefix "🔥 BAN: known bots " flags all
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} drop

# == 🚫 Blocking strange TCP flags (XMAS, NULL scans and others) ==
tcp flags & (fin|syn|rst|psh|ack|urg) == 0 drop # NULL scan
tcp flags & (fin|psh|urg) == (fin|psh|urg) drop # XMAS scan
tcp flags & (fin|syn) == (fin|syn) drop # SYN-ACK scan
tcp flags & (syn|rst|fin) == (syn|rst|fin) drop # Xmas scan
tcp flags & (syn|fin|rst|psh|ack) == (syn|rst|fin|ack) drop # Xmas scan

# == 🚫 Blocking fragmented packets — commonly used in filter evasion ==
ip frag-off & 0x1fff != 0 drop

# == 🔒 Blocking spoofed IP packets ==
ip saddr 127.0.0.0/8 drop # localhost
ip saddr 10.0.0.0/8 drop # private network
ip saddr 172.16.0.0/12 drop # private network
ip saddr 192.168.0.0/16 drop # private network
ip saddr 169.254.0.0/16 drop # APIPA
ip saddr 0.0.0.0/8 drop # invalid address
ip saddr 224.0.0.0/4 drop # multicast
ip saddr 240.0.0.0/5 drop # reserved
}

# = Main chain policy =
chain forward {
type filter hook forward priority 0;
policy accept;

# = Blocking various types of attacks =
# Required in chain forward only if Docker or Oracle VirtualBox is present.
# If needed — uncomment.

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
# ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
# ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
# ip protocol icmp icmp type echo-request limit rate 1/second accept
# ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
# ip protocol icmp icmp type echo-request drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports required for application operation ==
tcp dport {
53, # DNS — needed for domain name resolution
80, # HTTP — web traffic, updates and resource loading
443, # HTTPS — secure web traffic, VPN, browser
12043, # Custom 3D Application — specific client port
13000-13050 # Custom 3D Application — dynamic client port range
} accept

# == Allow UDP ports required for application operation ==
udp dport {
53, # DNS — needed for domain name resolution
443, # HTTPS via QUIC/HTTP3, browser protocols
3478, # STUN/TURN — WebRTC and video calls
3479-3481 # STUN/TURN — WebRTC and video calls
} accept

# = Blocking dangerous and unnecessary TCP/UDP ports and ranges =

# These blocklists are intended for a DESKTOP / workstation.
# They block remote access, outdated services, proxies, DBs, IoT, and ports
# often used by malware, scanners, and C2 infrastructures.
#
# ⚠ If you use the system as a SERVER, enable IP forwarding,
# or run services with internal routing
# (Docker NAT/bridge, VirtualBox host-only/bridged, VPN clients),
# carefully review the blocked ports/ranges in the forward chain —
# these services may need extra ports.
# Adjust or comment out required items if necessary.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high risk) ===
22, # SSH — common brute-force target
23, # Telnet — outdated, no encryption
3389, # RDP — Windows remote desktop
5900, # VNC — remote access, frequent vulnerabilities
# === FTP / SMB / NetBIOS (unsafe file-sharing protocols) ===
21, # FTP — insecure protocol
137, # NetBIOS Name Service
138, # NetBIOS Datagram
139, # NetBIOS Session
445, # SMB/CIFS — common exploit target
# === Databases (NEVER expose to the Internet) ===
3306, # MySQL/MariaDB
1433, # MS SQL Server
1434, # MS SQL Browser
# === HTTP-alt/Proxy/Elasticsearch (exploited frequently) ===
8080, # HTTP proxy / web interfaces — often exposed accidentally
9200, # Elasticsearch API — full remote data access
# === UPnP/IoT (insecure by design) ===
1900, # SSDP / UPnP
# === Common for malware (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell
5555, # Android ADB / IoT botnets
9001, # Tor transport (used by malware)
1234, # Netcat / reverse connections
1337, # Common C2 port used by malware
# === ⚠️ Scanner ports and potentially vulnerable services ===
1080, # SOCKS proxy — used to bypass filtering
3128, # Squid proxy — may be abused as open proxy
8000, # Alternative HTTP ports, dev servers
8888, # Web interfaces, proxies, dev tools
10000 # Webmin — remote admin panel, frequent attacks
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; abused by attackers
162 # SNMP Trap — also potentially vulnerable
} drop

# Attention! Blocking wide port ranges — be careful!
# Do not break system or application functionality!

# == TCP port ranges not used by a workstation during transit routing ==
# Blocked to prevent unwanted forwarding, hidden tunnels,
# NAT evasion, parasitic flows, and potential forward-path attacks.

tcp dport {
1024-2047, # System/legacy services; rarely needed in forward
2048-4095, # Proprietary daemons; NFS (2049) — check if used
4096-8191, # Old VPNs, some games, P2P; rarely needed on desktop
8192-12287, # Alternative HTTP/proxy, multimedia; test as needed
12288-16383, # Media/VoIP (TCP fallback); may break calls
16384-24575, # RTP/WebRTC (TCP fallback); block unless AV needed
24576-32767, # Dynamic ranges for games/VPN; may cause issues
32768-49151, # Registered/ephemeral; risky — may break NAT, Docker, VM
49152-65535 # High ephemeral; widely used by modern apps
} drop

# == 🚫 Blocking UDP ports — high and dynamic ranges ==
udp dport {
1024-9999, # low/mid ephemeral ports; used by trojans, P2P, games, VPN
10000-65535 # high ephemeral; used by dynamic apps, VPN, Docker
} drop

# = 🕷️ Suspicious IPs — large ranges often used by botnets, spam nets, and scanners =
ip saddr {
185.0.0.0/8, # abused hosting and proxy networks
37.0.0.0/8, # cheap VPS, frequent scanning sources
88.0.0.0/8, # common brute-force and scanner range
77.0.0.0/8, # TOR/proxy nodes
91.0.0.0/8 # botnets and “grey-zone” hosting
} drop
}

chain output {
# = Main chain policy =
type filter hook output priority 0;
policy accept;

# = Blocking various types of attacks =

# == 🔒 Limiting new connections from a single IP (anti-DDoS) ==
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# = ICMP protocol restrictions =

# == 🛡️ Ping limitation ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == Critically important ICMP for network ==
ip protocol icmp icmp type { destination-unreachable, time-exceeded, parameter-problem } accept

# == Important ICMPv6 for IPv6 ==
ip6 nexthdr icmpv6 icmpv6 type { 1, 2, 3, 4 } accept
ip6 nexthdr icmpv6 icmpv6 type { 135, 136 } accept # NS/NA
ip6 nexthdr icmpv6 icmpv6 type { 133, 134 } accept # RS/RA

# == Drop all other ICMP and ICMPv6 ==
ip protocol icmp drop # drop all other ICMP
ip6 nexthdr icmpv6 drop # drop all other ICMPv6

# = SCTP protocol blocking =
# 99.9% of desktop systems do not use SCTP at all
meta l4proto sctp drop

# = DCCP — Datagram Congestion Control Protocol blocking =
# Not used by any mainstream desktop applications
meta l4proto dccp drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports and ranges required for application functionality ==
tcp dport {
53, # DNS client. Required for Internet to work: domain name resolution (UDP/TCP).
80, # HTTP traffic to unencrypted websites; apps may use it for API/redirects.
443, # HTTPS. Main port for all encrypted web traffic — browsers, API, VPN, updates.
3306, # MySQL client. Needed if you connect to MySQL.
3478, # STUN/TURN WebRTC. Needed for audio/video/Discord.
3000, # Node.js dev servers. Needed for development.
3690, # SVN. If you work with an old repository.
4443, # Alternative HTTPS (some APIs). Also used by some VPN/clients.
12043, # Required for Custom 3D Application.
13000-13050 # Required for Custom 3D Application.
} accept

# == Allow UDP ports and ranges required for applications ==
udp dport {
443, # Required for fast and stable operation of modern websites
# (Google, YouTube, ChatGPT, Cloudflare)
13000-13050 # Required for Custom 3D Application.
} accept

# = Blocking potentially dangerous / unnecessary TCP/UDP ports =

# These blocks are intended for a DESKTOP / workstation.
# ⚠ If you use the system as a SERVER —
# adjust or comment out the required ports/ranges as needed.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high-risk) ===
22, # SSH — target of brute-force attacks.
23, # Telnet — outdated, unencrypted.
3389, # RDP — Windows remote access.
5900, # VNC — remote access, often vulnerable.
# === FTP / SMB / NetBIOS (dangerous file-sharing services) ===
21, # FTP — insecure protocol.
137, # NetBIOS Name Service.
138, # NetBIOS Datagram.
139, # NetBIOS Session.
445, # SMB/CIFS — frequent exploitation target.
# === Databases (NEVER open to the Internet) ===
3306, # MySQL/MariaDB.
1433, # MS SQL Server.
1434, # MS SQL Browser.
# === HTTP-alt/Proxy/Elasticsearch (dangerous, often attacked) ===
8080, # HTTP proxy / web interfaces — often exposed test interfaces.
9200, # Elasticsearch API — full remote access to data.
# === UPnP/IoT (vulnerable by design) ===
1900, # SSDP / UPnP.
# === Common malware ports (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell.
5555, # Android ADB / IoT botnets.
9001, # Tor transport (used by malware).
1234, # Netcat / reverse connections.
1337, # Common C2 malware port.
# === ⚠️ Ports of scanners and potentially vulnerable services ===
1080, # SOCKS proxy — often abused for bypassing filters.
3128, # Squid HTTP proxy — can be used as open proxy.
8000, # Alternative HTTP ports, web services — potentially vulnerable.
8888, # Alternative web interfaces — test and proxy ports.
10000 # Webmin — web admin panel, target of attacks.
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; can be abused by attackers.
162 # SNMP Trap — same, potential vulnerability.
} drop

# Warning! ⚠️ Be careful blocking wide port ranges! ⚠️
# Do not break system or application functionality!
# If you need a range — uncomment.
# If you don’t — comment out.

# == Blocking “dangerous” and desktop-unnecessary TCP port ranges ==
tcp dport {
1-1023, # 🛑 Privileged ports.
1024-2047, # r-commands (rlogin, rsh, rexec), old RPC, NFS, legacy daemons.
2048-3071, # Rare proprietary protocols and middleware.
3072-4999, # Mostly ports of legacy, server, corporate apps;
# rarely needed on workstations.
5000-5999, # Alternative services, old P2P/admin ports, rarely used on desktops.
7000-7999, # Alternative/test ports, often used by trojans.
9000-9999, # Web services, proxies, possible backdoor ports.
10000-19998, # Dynamic/high service ports; may be required by some apps like Custom 3D Application,
# but not needed by most desktop services.
19999-32767 # Old ephemeral port range; used by P2P, games, some VPNs,
# but system services rarely use them.
} drop

# == Blocking “dangerous” and desktop-unnecessary UDP port ranges ==
udp dport {
1024-2047, # Old UNIX services, RPC, NFS, r-commands, legacy daemons.
# Usually safe to block.
2048-4095, # Rarely used standard ports, proprietary services.
# Usually safe to block.
4096-8191, # VPN, games, P2P, WebRTC, VoIP of some clients.
# Can block, but cautiously: may affect VPN/apps.
8192-12287, # QUIC/HTTP3, proxies, multimedia protocols.
# Might cause side effects; better test first.
12288-16383, # Old RTP/VoIP ranges and media streams.
# Can block, but might break video calls.
16384-24575, # Main RTP range (audio/video), WebRTC, VoIP.
# ❗ Do not block if you need video calls/WebRTC/VPN.
24576-32767 # Dynamic ports for VPN, P2P, games, streaming data.
# ❗ May break VPN or some apps.
} drop

# == 🕷️ Blocking suspicious IPs —
# large ranges often used by botnets, spam networks, and scanners ==
ip saddr {
185.0.0.0/8, # Abused hosting and proxy networks.
37.0.0.0/8, # Cheap VPS, scanning sources.
88.0.0.0/8, # Frequent brute-force and scanners.
77.0.0.0/8, # Massive TOR/proxy nodes.
91.0.0.0/8 # Botnets and “grey” hosting.
} drop
}
}

</syntaxhighlight>

====== sysctl config: ======
kernel parameters configuration

/etc/sysctl.d/99-protect.conf<syntaxhighlight lang="bash">
# 1 Ignore ICMP on interfaces
net.ipv4.icmp_echo_ignore_all = 1

# 2 Do not respond to ICMP broadcast (against Smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 3 Enable SYN backlog reduction
net.ipv4.tcp_syncookies = 1

# 4 Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 5 Log packets with incorrect routing
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# 6 Disable ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# 7 Disable packet forwarding
net.ipv4.ip_forward = 0

# 8 Disable IPv6 support
net.ipv4.conf.all.disable_ipv6 = 1
net.ipv4.conf.default.disable_ipv6 = 1

# 9 Prevent sending TCP segments with null windows
net.ipv4.tcp_rfc1337 = 1

# 10 Disable ARP filtering for automatic routing
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1

# 11 Limit the maximum size of the incoming TCP window
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# 12 Drop packets with incorrect checksums
net.ipv4.conf.all.drop_unicast_in_l2_multicast = 1
net.ipv4.conf.default.drop_unicast_in_l2_multicast = 1

# 13 Disable IPv6 forwarding
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# 14 Limit the maximum number of SYN packet retries
net.ipv4.tcp_synack_retries = 2

# 15 Increase routing cache lifetime
net.ipv4.route.max_size = 32768
</syntaxhighlight>

====== auditd rules config: ======
/etc/audit/rules.d/audit.rules

<syntaxhighlight lang="bash">
## Flush rules
-D

## Buffers
-b 8192
--backlog_wait_time 60000
-f 1

## Network audit
-a always,exit -F arch=b64 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b64 -S accept4 -F success=1 -k network_accept
-a always,exit -F arch=b32 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b32 -S accept4 -F success=1 -k network_accept

## Logging execve commands
-a always,exit -F arch=b64 -S execve -F key=exec_log

## Audit logins and sessions
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session

## sudo / su
-w /etc/sudoers -p wa -k sudo
-w /etc/sudoers.d/ -p wa -k sudo
-w /bin/su -p x -k su_cmd

## Account and configuration changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/hosts -p wa -k system_conf
-w /etc/hostname -p wa -k system_conf
-w /etc/resolv.conf -p wa -k system_conf
-w /etc/issue -p wa -k system_conf
-w /etc/network/ -p wa -k system_conf

## Time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -F key=time_change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -F key=time_change

## Audit SSH connections and changes
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /var/log/auth.log -p wa -k ssh_login

## Audit usage of remote tools (e.g., SSH, netcat)
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/nc -k nc_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/nc -k nc_process

## Audit privileged access
-a always,exit -F arch=b64 -S setuid -S setgid -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -S setgid -k privilege_escalation
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/sudoers.d/ -p wa -k sudoers_changes
-w /bin/sudo -p x -k sudo_command

## Monitor credential changes
#-w /root/.ssh/ -p wa -k ssh_keys
#-w /home/*/.ssh/ -p wa -k ssh_keys

## Audit use of remote network services
-a always,exit -F arch=b64 -S socket -F success=1 -k socket_connect
-a always,exit -F arch=b32 -S socket -F success=1 -k socket_connect

# Log package installation and removal via dpkg
-w /usr/bin/dpkg -p x
-w /usr/sbin/apt-get -p x
-w /usr/bin/apt -p x
</syntaxhighlight>

==== UsefulPrograms ====

Here is the list of programs useful for configuring and maintaining the security of Linux systems. The included programs are either open-source (the majority) or commercial, but with freely available limited features sufficient to address core security tasks (a smaller portion).

https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/UsefulPrograms

==== External Resources ====

[https://www.debian.org/doc/manuals/securing-debian-manual/index.en.html|Securing Debian Manual 3.19 — Javier Fernández-Sanguino Peña.]
This document describes security in the Debian project and in the Debian operating system. Starting with the process of securing and hardening the default Debian GNU/Linux distribution installation, it also covers some of the common tasks to set up a secure network environment using Debian GNU/Linux, gives additional information on the security tools available and talks about how security is enforced in Debian by the security and audit team.

[https://medium.com/%40ihouelecaurcy/the-complete-nftables-guide-modern-linux-firewall-mastery-79fb86894d5c|The Complete nftables Guide: Modern Linux Firewall Mastery — Ihouele Caurcy]
The definitive guide to nftables — the modern replacement for iptables, ip6tables, arptables, and ebtables. From basic concepts to enterprise-level configurations.

[https://notes.suhaib.in/docs/tech/utilities/iptables-nftables-and-you-a-friendly-guide-to-traffic-rules/|iptables, nftables, and You A Friendly Guide to Traffic Rules]
A friendly guide to iptables and nftables in Linux: explains Netfilter architecture, tables, chains and rules, with configuration examples (SSH, IP blocking, port forwarding). Covers differences between iptables and nftables, migration, and compatibility with modern firewall tools. Useful for understanding the iptables→nftables transition and practical examples.

[https://public.jdstone1.com/books_and_magazines/Computer_Books/Operating_Systems/SELinux%20System%20Administration%20(3rd%20ed).pdf|SELinux System Administration Third Edition — Sven Vermeulen.]
Implement mandatory access control to secure applications, users, and information flows on Linux.

[https://gitlab.com/apparmor/apparmor/-/wikis/home AppArmor]
The official wiki for the AppArmor security project on Linux. Provides guidance for users and developers, instructions for creating and managing security profiles, example access policies for applications, and best practices to protect the operating system.

[https://nallino.net/stockage/security/Linux_Mint_Security.pdf|Security, Privacy and Anonymity in Linux Mint — Michel Nallino.]
A good and comprehensive work on Linux Mint security that can also be useful for other Linux distributions.

[https://www.cisa.gov/topics/cybersecurity-best-practices|CISA — Cybersecurity Best Practices]
CISA (Certified Information Systems Auditor) provides information on cybersecurity best practices to help individuals and organizations implement preventative measures and manage cyber risks.

==== Provenance ====

This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131

it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks

[[index.php?title=Category:Security]]
[[index.php?title=Category:Hardening]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2025-12-16T17:50:36Z

Blackcat568: added new chapter ==== Source ====

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.

* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

===== Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build). =====
Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

# 1. Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.
# If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to type long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>
# Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.
# Avoid using the superuser account or sudo without a clear necessity — and never execute arbitrary scripts with sudo. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
## Always read a script fully before running it (less script.sh, cat script.sh).
## Never paste commands from untrusted or unverified sources into the terminal.
## Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
## Follow the principle of least privilege — create separate user accounts and limit access rights where possible Important: Improper or careless use of sudo and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.
# Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. You may also consider switching to SELinux. If you have difficulty configuring AppArmor or SELinux, seek help from specialists or use AI-based tools. My SELinux configuration is attached below (I use SELinux on Debian 12 — it works reliably).
# Use advanced network filtering settings: iptables or nftables, or a commercial firewall. (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#nftables config:|nftables config]]
# Configure kernel parameters for maximum security (sysctl hardening). (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#sysctl config:|sysctl config]])
# Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event). (sample [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#auditd rules config:|auditd rules config]]
# Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.
# If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.
# Follow the principle of Attack Surface Reduction (or [https://en.wikipedia.org/wiki/Occam's_razor Occam's Razor]) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
## If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
## If you are certain you will never use it, remove it completely from the system.
## This practice reduces potential attack vectors and strengthens overall system security.
## Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications. Always create a full system backup before making any significant configuration changes or modifications.
# Perform regular antivirus and anti-rootkit scans of the system. In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.
# Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:
<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

'''Related Aspects of Internet Security'''

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

1. Store passwords in a reliable password manager.

'''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:

* relying on human memory, with the risk of forgetting or confusing credentials;
* storing passwords on paper media, which can be damaged, lost, or stolen;
* saving passwords in web browsers in unencrypted form;
* keeping passwords in plain text files on the desktop or in other directories without encryption;
* and similar approaches.

Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.

A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.

* Regularly create up-to-date backups of the ''encrypted'' password database.

* Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.

Additional Practical Recommendations

A password manager (for example, KeePassXC) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.

In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.

It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).

2. Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [[wikipedia:Authenticator_app|Authenticator_app]]), or a hardware security key such as a [[wikipedia:YubiKey|YubiKey]].

This is a critical cybersecurity measure — neglecting it can completely undermine all your efforts in configuring a secure Linux system.

The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:

* YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
* It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
* Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number. For now, it is one of the most reliable hardware-based options for two-factor authentication.

3. Using VPN to improve privacy and security

''If you are a private user'', you can also configure a system-wide VPN (for example, ProtonVPN) so that all device traffic is routed through it — not only browser traffic or traffic from specific applications.

Enable the “killswitch” mode and disable it only when necessary, re-enabling it immediately afterwards.

It is also recommended to periodically change VPN servers, doing so at different and unpredictable intervals.

Using a VPN increases your privacy: all of your traffic will be encrypted from observers on your local network and from your internet service provider. This makes it more difficult for an attacker to apply certain social-engineering methods based on traffic analysis, and it also helps protect your privacy in the event that your provider’s infrastructure is compromised.

''If you own a server'' and want access to it to be available only to trusted private or legal entities, while also increasing its protection against unauthorized access, you can configure the server so that SSH and other internal services are accessible exclusively through OpenVPN using TLS authentication (tls-auth / tls-crypt) and unique client certificates instead of passwords.

4. Actively study and apply artificial intelligence to improve security configurations in Debian and other Linux distributions, as well as to address related cybersecurity tasks. A lack of knowledge often becomes the weakest link; AI can provide accurate, structured recommendations interactively and help automate repetitive or complex operations.

5. If privacy is a priority, consider reducing reliance on the Google ecosystem and switching to more privacy-focused alternatives (for example, proton.me and similar services). Google provides very strong security, but its services collect extensive telemetry for analysis. While this data is encrypted and not accessible to attackers, it may still be undesirable for users who value strict privacy.

''Always verify AI-generated recommendations before applying them in production environments. Test any changes in an isolated system, review generated commands or configurations, and ensure that suggestions align with your threat model and security architecture.''

''In practice, users who effectively leverage AI tools are significantly better prepared, and the adoption of such technologies makes malicious activity considerably more difficult for attackers.''

'''''Note:''' Artificial intelligence tools are mentioned here as optional technical aids, not as an endorsement of any specific service or vendor.''

6. It is also important to consider the possibility of hardware-level attacks.

Although such attacks are significantly less common and typically require more resources than software-based attacks, they remain a potential threat. In certain scenarios, an adversary may exploit vulnerabilities in device firmware or conduct a combined attack targeting both software and hardware layers. Examples include remote injection of malicious code into the firmware of a motherboard, router, optical modem, or other hardware components.

If, after a thorough software-level audit, a security issue remains unresolved, it is advisable <nowiki>'''</nowiki>to perform a hardware-level assessment<nowiki>'''</nowiki> as well, including verification of device firmware integrity and configuration.

<blockquote>'''And most importantly — give up the illusion of complete security. We live in conditions of a severe information war, and everyone must make efforts so that malicious actors cannot freely spy on desktops and servers.'''</blockquote>

'''Examples of Deep Custom Security Configurations'''

Below are examples of strong, individualized configurations for '''SELinux''', '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

====== SELinux config: ======
<syntaxhighlight lang="terminfo">
root@user:/home/user# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
root@user:/home/user# sestatus -v
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

Process contexts:
Current context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Init context: system_u:system_r:init_t:s0
/sbin/agetty system_u:system_r:getty_t:s0

File contexts:
Controlling terminal: unconfined_u:object_r:user_devpts_t:s0
/etc/passwd system_u:object_r:etc_t:s0
/etc/shadow system_u:object_r:unlabeled_t:s0
/bin/bash system_u:object_r:shell_exec_t:s0
/bin/login system_u:object_r:login_exec_t:s0
/bin/sh system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0
/sbin/agetty system_u:object_r:getty_exec_t:s0
/sbin/init system_u:object_r:bin_t:s0 -> system_u:object_r:init_exec_t:s0
/lib/ld-linux.so.2 system_u:object_r:lib_t:s0 -> system_u:object_r:ld_so_t:s0
</syntaxhighlight>

====== nftables config: ======
<syntaxhighlight lang="bash">
#!/usr/sbin/nft -f

flush ruleset

table inet filter {

# = Main chain policy =
chain input {
type filter hook input priority 0;
policy drop;

# = Common rule set =
# 🌀 Allow loopback interface (internal system processes)
iif "lo" accept

# == 🔁 Allow established and related connections ==
ct state established,related accept

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# == 🔒 Limit the rate of NEW connections per source IP (basic anti-DDoS protection) ==
# If you experience issues with slow or failed page loads in your browser,
# try increasing the limit, for example:
# ip saddr 0.0.0.0/0 ct state new limit rate 50/second burst 100 packets accept
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == 🚫 Blocking SSDP and mDNS (local broadcast discovery protocols) ==
ip daddr 239.255.255.250 udp dport 1900 drop # ❌ SSDP (UPnP/device discovery)
ip daddr 224.0.0.251 udp dport 5353 drop # ❌ mDNS (Bonjour, Avahi)

# == 🛑 Blocking NetBIOS and LLMNR (Windows/systemd internal LAN protocols) ==
udp dport 137 drop # ❌ NetBIOS Name Service (Windows network names)
udp dport 138 drop # ❌ NetBIOS Datagram Service (LAN name discovery)
udp dport 5355 drop # ❌ LLMNR (Link-Local Multicast Name Resolution)

# = Set of blocked IP addresses and ranges =

# == 🧱 Blocking known botnets and proxy networks ==
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} log prefix "🔥 BAN: known bots " flags all
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} drop

# == 🚫 Blocking strange TCP flags (XMAS, NULL scans and others) ==
tcp flags & (fin|syn|rst|psh|ack|urg) == 0 drop # NULL scan
tcp flags & (fin|psh|urg) == (fin|psh|urg) drop # XMAS scan
tcp flags & (fin|syn) == (fin|syn) drop # SYN-ACK scan
tcp flags & (syn|rst|fin) == (syn|rst|fin) drop # Xmas scan
tcp flags & (syn|fin|rst|psh|ack) == (syn|rst|fin|ack) drop # Xmas scan

# == 🚫 Blocking fragmented packets — commonly used in filter evasion ==
ip frag-off & 0x1fff != 0 drop

# == 🔒 Blocking spoofed IP packets ==
ip saddr 127.0.0.0/8 drop # localhost
ip saddr 10.0.0.0/8 drop # private network
ip saddr 172.16.0.0/12 drop # private network
ip saddr 192.168.0.0/16 drop # private network
ip saddr 169.254.0.0/16 drop # APIPA
ip saddr 0.0.0.0/8 drop # invalid address
ip saddr 224.0.0.0/4 drop # multicast
ip saddr 240.0.0.0/5 drop # reserved
}

# = Main chain policy =
chain forward {
type filter hook forward priority 0;
policy accept;

# = Blocking various types of attacks =
# Required in chain forward only if Docker or Oracle VirtualBox is present.
# If needed — uncomment.

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
# ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
# ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
# ip protocol icmp icmp type echo-request limit rate 1/second accept
# ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
# ip protocol icmp icmp type echo-request drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports required for application operation ==
tcp dport {
53, # DNS — needed for domain name resolution
80, # HTTP — web traffic, updates and resource loading
443, # HTTPS — secure web traffic, VPN, browser
12043, # Custom 3D Application — specific client port
13000-13050 # Custom 3D Application — dynamic client port range
} accept

# == Allow UDP ports required for application operation ==
udp dport {
53, # DNS — needed for domain name resolution
443, # HTTPS via QUIC/HTTP3, browser protocols
3478, # STUN/TURN — WebRTC and video calls
3479-3481 # STUN/TURN — WebRTC and video calls
} accept

# = Blocking dangerous and unnecessary TCP/UDP ports and ranges =

# These blocklists are intended for a DESKTOP / workstation.
# They block remote access, outdated services, proxies, DBs, IoT, and ports
# often used by malware, scanners, and C2 infrastructures.
#
# ⚠ If you use the system as a SERVER, enable IP forwarding,
# or run services with internal routing
# (Docker NAT/bridge, VirtualBox host-only/bridged, VPN clients),
# carefully review the blocked ports/ranges in the forward chain —
# these services may need extra ports.
# Adjust or comment out required items if necessary.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high risk) ===
22, # SSH — common brute-force target
23, # Telnet — outdated, no encryption
3389, # RDP — Windows remote desktop
5900, # VNC — remote access, frequent vulnerabilities
# === FTP / SMB / NetBIOS (unsafe file-sharing protocols) ===
21, # FTP — insecure protocol
137, # NetBIOS Name Service
138, # NetBIOS Datagram
139, # NetBIOS Session
445, # SMB/CIFS — common exploit target
# === Databases (NEVER expose to the Internet) ===
3306, # MySQL/MariaDB
1433, # MS SQL Server
1434, # MS SQL Browser
# === HTTP-alt/Proxy/Elasticsearch (exploited frequently) ===
8080, # HTTP proxy / web interfaces — often exposed accidentally
9200, # Elasticsearch API — full remote data access
# === UPnP/IoT (insecure by design) ===
1900, # SSDP / UPnP
# === Common for malware (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell
5555, # Android ADB / IoT botnets
9001, # Tor transport (used by malware)
1234, # Netcat / reverse connections
1337, # Common C2 port used by malware
# === ⚠️ Scanner ports and potentially vulnerable services ===
1080, # SOCKS proxy — used to bypass filtering
3128, # Squid proxy — may be abused as open proxy
8000, # Alternative HTTP ports, dev servers
8888, # Web interfaces, proxies, dev tools
10000 # Webmin — remote admin panel, frequent attacks
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; abused by attackers
162 # SNMP Trap — also potentially vulnerable
} drop

# Attention! Blocking wide port ranges — be careful!
# Do not break system or application functionality!

# == TCP port ranges not used by a workstation during transit routing ==
# Blocked to prevent unwanted forwarding, hidden tunnels,
# NAT evasion, parasitic flows, and potential forward-path attacks.

tcp dport {
1024-2047, # System/legacy services; rarely needed in forward
2048-4095, # Proprietary daemons; NFS (2049) — check if used
4096-8191, # Old VPNs, some games, P2P; rarely needed on desktop
8192-12287, # Alternative HTTP/proxy, multimedia; test as needed
12288-16383, # Media/VoIP (TCP fallback); may break calls
16384-24575, # RTP/WebRTC (TCP fallback); block unless AV needed
24576-32767, # Dynamic ranges for games/VPN; may cause issues
32768-49151, # Registered/ephemeral; risky — may break NAT, Docker, VM
49152-65535 # High ephemeral; widely used by modern apps
} drop

# == 🚫 Blocking UDP ports — high and dynamic ranges ==
udp dport {
1024-9999, # low/mid ephemeral ports; used by trojans, P2P, games, VPN
10000-65535 # high ephemeral; used by dynamic apps, VPN, Docker
} drop

# = 🕷️ Suspicious IPs — large ranges often used by botnets, spam nets, and scanners =
ip saddr {
185.0.0.0/8, # abused hosting and proxy networks
37.0.0.0/8, # cheap VPS, frequent scanning sources
88.0.0.0/8, # common brute-force and scanner range
77.0.0.0/8, # TOR/proxy nodes
91.0.0.0/8 # botnets and “grey-zone” hosting
} drop
}

chain output {
# = Main chain policy =
type filter hook output priority 0;
policy accept;

# = Blocking various types of attacks =

# == 🔒 Limiting new connections from a single IP (anti-DDoS) ==
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# = ICMP protocol restrictions =

# == 🛡️ Ping limitation ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == Critically important ICMP for network ==
ip protocol icmp icmp type { destination-unreachable, time-exceeded, parameter-problem } accept

# == Important ICMPv6 for IPv6 ==
ip6 nexthdr icmpv6 icmpv6 type { 1, 2, 3, 4 } accept
ip6 nexthdr icmpv6 icmpv6 type { 135, 136 } accept # NS/NA
ip6 nexthdr icmpv6 icmpv6 type { 133, 134 } accept # RS/RA

# == Drop all other ICMP and ICMPv6 ==
ip protocol icmp drop # drop all other ICMP
ip6 nexthdr icmpv6 drop # drop all other ICMPv6

# = SCTP protocol blocking =
# 99.9% of desktop systems do not use SCTP at all
meta l4proto sctp drop

# = DCCP — Datagram Congestion Control Protocol blocking =
# Not used by any mainstream desktop applications
meta l4proto dccp drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports and ranges required for application functionality ==
tcp dport {
53, # DNS client. Required for Internet to work: domain name resolution (UDP/TCP).
80, # HTTP traffic to unencrypted websites; apps may use it for API/redirects.
443, # HTTPS. Main port for all encrypted web traffic — browsers, API, VPN, updates.
3306, # MySQL client. Needed if you connect to MySQL.
3478, # STUN/TURN WebRTC. Needed for audio/video/Discord.
3000, # Node.js dev servers. Needed for development.
3690, # SVN. If you work with an old repository.
4443, # Alternative HTTPS (some APIs). Also used by some VPN/clients.
12043, # Required for Custom 3D Application.
13000-13050 # Required for Custom 3D Application.
} accept

# == Allow UDP ports and ranges required for applications ==
udp dport {
443, # Required for fast and stable operation of modern websites
# (Google, YouTube, ChatGPT, Cloudflare)
13000-13050 # Required for Custom 3D Application.
} accept

# = Blocking potentially dangerous / unnecessary TCP/UDP ports =

# These blocks are intended for a DESKTOP / workstation.
# ⚠ If you use the system as a SERVER —
# adjust or comment out the required ports/ranges as needed.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high-risk) ===
22, # SSH — target of brute-force attacks.
23, # Telnet — outdated, unencrypted.
3389, # RDP — Windows remote access.
5900, # VNC — remote access, often vulnerable.
# === FTP / SMB / NetBIOS (dangerous file-sharing services) ===
21, # FTP — insecure protocol.
137, # NetBIOS Name Service.
138, # NetBIOS Datagram.
139, # NetBIOS Session.
445, # SMB/CIFS — frequent exploitation target.
# === Databases (NEVER open to the Internet) ===
3306, # MySQL/MariaDB.
1433, # MS SQL Server.
1434, # MS SQL Browser.
# === HTTP-alt/Proxy/Elasticsearch (dangerous, often attacked) ===
8080, # HTTP proxy / web interfaces — often exposed test interfaces.
9200, # Elasticsearch API — full remote access to data.
# === UPnP/IoT (vulnerable by design) ===
1900, # SSDP / UPnP.
# === Common malware ports (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell.
5555, # Android ADB / IoT botnets.
9001, # Tor transport (used by malware).
1234, # Netcat / reverse connections.
1337, # Common C2 malware port.
# === ⚠️ Ports of scanners and potentially vulnerable services ===
1080, # SOCKS proxy — often abused for bypassing filters.
3128, # Squid HTTP proxy — can be used as open proxy.
8000, # Alternative HTTP ports, web services — potentially vulnerable.
8888, # Alternative web interfaces — test and proxy ports.
10000 # Webmin — web admin panel, target of attacks.
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; can be abused by attackers.
162 # SNMP Trap — same, potential vulnerability.
} drop

# Warning! ⚠️ Be careful blocking wide port ranges! ⚠️
# Do not break system or application functionality!
# If you need a range — uncomment.
# If you don’t — comment out.

# == Blocking “dangerous” and desktop-unnecessary TCP port ranges ==
tcp dport {
1-1023, # 🛑 Privileged ports.
1024-2047, # r-commands (rlogin, rsh, rexec), old RPC, NFS, legacy daemons.
2048-3071, # Rare proprietary protocols and middleware.
3072-4999, # Mostly ports of legacy, server, corporate apps;
# rarely needed on workstations.
5000-5999, # Alternative services, old P2P/admin ports, rarely used on desktops.
7000-7999, # Alternative/test ports, often used by trojans.
9000-9999, # Web services, proxies, possible backdoor ports.
10000-19998, # Dynamic/high service ports; may be required by some apps like Custom 3D Application,
# but not needed by most desktop services.
19999-32767 # Old ephemeral port range; used by P2P, games, some VPNs,
# but system services rarely use them.
} drop

# == Blocking “dangerous” and desktop-unnecessary UDP port ranges ==
udp dport {
1024-2047, # Old UNIX services, RPC, NFS, r-commands, legacy daemons.
# Usually safe to block.
2048-4095, # Rarely used standard ports, proprietary services.
# Usually safe to block.
4096-8191, # VPN, games, P2P, WebRTC, VoIP of some clients.
# Can block, but cautiously: may affect VPN/apps.
8192-12287, # QUIC/HTTP3, proxies, multimedia protocols.
# Might cause side effects; better test first.
12288-16383, # Old RTP/VoIP ranges and media streams.
# Can block, but might break video calls.
16384-24575, # Main RTP range (audio/video), WebRTC, VoIP.
# ❗ Do not block if you need video calls/WebRTC/VPN.
24576-32767 # Dynamic ports for VPN, P2P, games, streaming data.
# ❗ May break VPN or some apps.
} drop

# == 🕷️ Blocking suspicious IPs —
# large ranges often used by botnets, spam networks, and scanners ==
ip saddr {
185.0.0.0/8, # Abused hosting and proxy networks.
37.0.0.0/8, # Cheap VPS, scanning sources.
88.0.0.0/8, # Frequent brute-force and scanners.
77.0.0.0/8, # Massive TOR/proxy nodes.
91.0.0.0/8 # Botnets and “grey” hosting.
} drop
}
}

</syntaxhighlight>

====== sysctl config: ======
kernel parameters configuration

/etc/sysctl.d/99-protect.conf<syntaxhighlight lang="bash">
# 1 Ignore ICMP on interfaces
net.ipv4.icmp_echo_ignore_all = 1

# 2 Do not respond to ICMP broadcast (against Smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 3 Enable SYN backlog reduction
net.ipv4.tcp_syncookies = 1

# 4 Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 5 Log packets with incorrect routing
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# 6 Disable ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# 7 Disable packet forwarding
net.ipv4.ip_forward = 0

# 8 Disable IPv6 support
net.ipv4.conf.all.disable_ipv6 = 1
net.ipv4.conf.default.disable_ipv6 = 1

# 9 Prevent sending TCP segments with null windows
net.ipv4.tcp_rfc1337 = 1

# 10 Disable ARP filtering for automatic routing
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1

# 11 Limit the maximum size of the incoming TCP window
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# 12 Drop packets with incorrect checksums
net.ipv4.conf.all.drop_unicast_in_l2_multicast = 1
net.ipv4.conf.default.drop_unicast_in_l2_multicast = 1

# 13 Disable IPv6 forwarding
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# 14 Limit the maximum number of SYN packet retries
net.ipv4.tcp_synack_retries = 2

# 15 Increase routing cache lifetime
net.ipv4.route.max_size = 32768
</syntaxhighlight>

====== auditd rules config: ======
/etc/audit/rules.d/audit.rules

<syntaxhighlight lang="bash">
## Flush rules
-D

## Buffers
-b 8192
--backlog_wait_time 60000
-f 1

## Network audit
-a always,exit -F arch=b64 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b64 -S accept4 -F success=1 -k network_accept
-a always,exit -F arch=b32 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b32 -S accept4 -F success=1 -k network_accept

## Logging execve commands
-a always,exit -F arch=b64 -S execve -F key=exec_log

## Audit logins and sessions
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session

## sudo / su
-w /etc/sudoers -p wa -k sudo
-w /etc/sudoers.d/ -p wa -k sudo
-w /bin/su -p x -k su_cmd

## Account and configuration changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/hosts -p wa -k system_conf
-w /etc/hostname -p wa -k system_conf
-w /etc/resolv.conf -p wa -k system_conf
-w /etc/issue -p wa -k system_conf
-w /etc/network/ -p wa -k system_conf

## Time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -F key=time_change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -F key=time_change

## Audit SSH connections and changes
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /var/log/auth.log -p wa -k ssh_login

## Audit usage of remote tools (e.g., SSH, netcat)
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/nc -k nc_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/nc -k nc_process

## Audit privileged access
-a always,exit -F arch=b64 -S setuid -S setgid -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -S setgid -k privilege_escalation
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/sudoers.d/ -p wa -k sudoers_changes
-w /bin/sudo -p x -k sudo_command

## Monitor credential changes
#-w /root/.ssh/ -p wa -k ssh_keys
#-w /home/*/.ssh/ -p wa -k ssh_keys

## Audit use of remote network services
-a always,exit -F arch=b64 -S socket -F success=1 -k socket_connect
-a always,exit -F arch=b32 -S socket -F success=1 -k socket_connect

# Log package installation and removal via dpkg
-w /usr/bin/dpkg -p x
-w /usr/sbin/apt-get -p x
-w /usr/bin/apt -p x
</syntaxhighlight>

==== UsefulPrograms ====

Here is the list of programs useful for configuring and maintaining the security of Linux systems. The included programs are either open-source (the majority) or commercial, but with freely available limited features sufficient to address core security tasks (a smaller portion).

https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/UsefulPrograms

==== External Resources ====

[https://www.debian.org/doc/manuals/securing-debian-manual/index.en.html|Securing Debian Manual 3.19 — Javier Fernández-Sanguino Peña.]
This document describes security in the Debian project and in the Debian operating system. Starting with the process of securing and hardening the default Debian GNU/Linux distribution installation, it also covers some of the common tasks to set up a secure network environment using Debian GNU/Linux, gives additional information on the security tools available and talks about how security is enforced in Debian by the security and audit team.

[https://medium.com/%40ihouelecaurcy/the-complete-nftables-guide-modern-linux-firewall-mastery-79fb86894d5c|The Complete nftables Guide: Modern Linux Firewall Mastery — Ihouele Caurcy]
The definitive guide to nftables — the modern replacement for iptables, ip6tables, arptables, and ebtables. From basic concepts to enterprise-level configurations.

[https://notes.suhaib.in/docs/tech/utilities/iptables-nftables-and-you-a-friendly-guide-to-traffic-rules/|iptables, nftables, and You A Friendly Guide to Traffic Rules]
A friendly guide to iptables and nftables in Linux: explains Netfilter architecture, tables, chains and rules, with configuration examples (SSH, IP blocking, port forwarding). Covers differences between iptables and nftables, migration, and compatibility with modern firewall tools. Useful for understanding the iptables→nftables transition and practical examples.

[https://public.jdstone1.com/books_and_magazines/Computer_Books/Operating_Systems/SELinux%20System%20Administration%20(3rd%20ed).pdf|SELinux System Administration Third Edition — Sven Vermeulen.]
Implement mandatory access control to secure applications, users, and information flows on Linux.

[https://gitlab.com/apparmor/apparmor/-/wikis/home AppArmor]
The official wiki for the AppArmor security project on Linux. Provides guidance for users and developers, instructions for creating and managing security profiles, example access policies for applications, and best practices to protect the operating system.

[https://nallino.net/stockage/security/Linux_Mint_Security.pdf|Security, Privacy and Anonymity in Linux Mint — Michel Nallino.]
A good and comprehensive work on Linux Mint security that can also be useful for other Linux distributions.

[https://www.cisa.gov/topics/cybersecurity-best-practices|CISA — Cybersecurity Best Practices]
CISA (Certified Information Systems Auditor) provides information on cybersecurity best practices to help individuals and organizations implement preventative measures and manage cyber risks.

==== Source ====

This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131

it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks

[[index.php?title=Category:Security]]
[[index.php?title=Category:Hardening]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2025-12-16T17:41:39Z

Blackcat568: /* External Resources */

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.

* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

===== Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build). =====
Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

# 1. Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.
# If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to type long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>
# Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.
# Avoid using the superuser account or sudo without a clear necessity — and never execute arbitrary scripts with sudo. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
## Always read a script fully before running it (less script.sh, cat script.sh).
## Never paste commands from untrusted or unverified sources into the terminal.
## Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
## Follow the principle of least privilege — create separate user accounts and limit access rights where possible Important: Improper or careless use of sudo and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.
# Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. You may also consider switching to SELinux. If you have difficulty configuring AppArmor or SELinux, seek help from specialists or use AI-based tools. My SELinux configuration is attached below (I use SELinux on Debian 12 — it works reliably).
# Use advanced network filtering settings: iptables or nftables, or a commercial firewall. (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#nftables config:|nftables config]]
# Configure kernel parameters for maximum security (sysctl hardening). (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#sysctl config:|sysctl config]])
# Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event). (sample [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#auditd rules config:|auditd rules config]]
# Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.
# If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.
# Follow the principle of Attack Surface Reduction (or [https://en.wikipedia.org/wiki/Occam's_razor Occam's Razor]) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
## If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
## If you are certain you will never use it, remove it completely from the system.
## This practice reduces potential attack vectors and strengthens overall system security.
## Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications. Always create a full system backup before making any significant configuration changes or modifications.
# Perform regular antivirus and anti-rootkit scans of the system. In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.
# Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:
<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

'''Related Aspects of Internet Security'''

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

1. Store passwords in a reliable password manager.

'''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:

* relying on human memory, with the risk of forgetting or confusing credentials;
* storing passwords on paper media, which can be damaged, lost, or stolen;
* saving passwords in web browsers in unencrypted form;
* keeping passwords in plain text files on the desktop or in other directories without encryption;
* and similar approaches.

Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.

A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.

* Regularly create up-to-date backups of the ''encrypted'' password database.

* Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.

Additional Practical Recommendations

A password manager (for example, KeePassXC) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.

In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.

It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).

2. Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [[wikipedia:Authenticator_app|Authenticator_app]]), or a hardware security key such as a [[wikipedia:YubiKey|YubiKey]].

This is a critical cybersecurity measure — neglecting it can completely undermine all your efforts in configuring a secure Linux system.

The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:

* YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
* It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
* Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number. For now, it is one of the most reliable hardware-based options for two-factor authentication.

3. Using VPN to improve privacy and security

''If you are a private user'', you can also configure a system-wide VPN (for example, ProtonVPN) so that all device traffic is routed through it — not only browser traffic or traffic from specific applications.

Enable the “killswitch” mode and disable it only when necessary, re-enabling it immediately afterwards.

It is also recommended to periodically change VPN servers, doing so at different and unpredictable intervals.

Using a VPN increases your privacy: all of your traffic will be encrypted from observers on your local network and from your internet service provider. This makes it more difficult for an attacker to apply certain social-engineering methods based on traffic analysis, and it also helps protect your privacy in the event that your provider’s infrastructure is compromised.

''If you own a server'' and want access to it to be available only to trusted private or legal entities, while also increasing its protection against unauthorized access, you can configure the server so that SSH and other internal services are accessible exclusively through OpenVPN using TLS authentication (tls-auth / tls-crypt) and unique client certificates instead of passwords.

4. Actively study and apply artificial intelligence to improve security configurations in Debian and other Linux distributions, as well as to address related cybersecurity tasks. A lack of knowledge often becomes the weakest link; AI can provide accurate, structured recommendations interactively and help automate repetitive or complex operations.

5. If privacy is a priority, consider reducing reliance on the Google ecosystem and switching to more privacy-focused alternatives (for example, proton.me and similar services). Google provides very strong security, but its services collect extensive telemetry for analysis. While this data is encrypted and not accessible to attackers, it may still be undesirable for users who value strict privacy.

''Always verify AI-generated recommendations before applying them in production environments. Test any changes in an isolated system, review generated commands or configurations, and ensure that suggestions align with your threat model and security architecture.''

''In practice, users who effectively leverage AI tools are significantly better prepared, and the adoption of such technologies makes malicious activity considerably more difficult for attackers.''

'''''Note:''' Artificial intelligence tools are mentioned here as optional technical aids, not as an endorsement of any specific service or vendor.''

6. It is also important to consider the possibility of hardware-level attacks.

Although such attacks are significantly less common and typically require more resources than software-based attacks, they remain a potential threat. In certain scenarios, an adversary may exploit vulnerabilities in device firmware or conduct a combined attack targeting both software and hardware layers. Examples include remote injection of malicious code into the firmware of a motherboard, router, optical modem, or other hardware components.

If, after a thorough software-level audit, a security issue remains unresolved, it is advisable <nowiki>'''</nowiki>to perform a hardware-level assessment<nowiki>'''</nowiki> as well, including verification of device firmware integrity and configuration.

<blockquote>'''And most importantly — give up the illusion of complete security. We live in conditions of a severe information war, and everyone must make efforts so that malicious actors cannot freely spy on desktops and servers.'''</blockquote>

'''Examples of Deep Custom Security Configurations'''

Below are examples of strong, individualized configurations for '''SELinux''', '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

====== SELinux config: ======
<syntaxhighlight lang="terminfo">
root@user:/home/user# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
root@user:/home/user# sestatus -v
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

Process contexts:
Current context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Init context: system_u:system_r:init_t:s0
/sbin/agetty system_u:system_r:getty_t:s0

File contexts:
Controlling terminal: unconfined_u:object_r:user_devpts_t:s0
/etc/passwd system_u:object_r:etc_t:s0
/etc/shadow system_u:object_r:unlabeled_t:s0
/bin/bash system_u:object_r:shell_exec_t:s0
/bin/login system_u:object_r:login_exec_t:s0
/bin/sh system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0
/sbin/agetty system_u:object_r:getty_exec_t:s0
/sbin/init system_u:object_r:bin_t:s0 -> system_u:object_r:init_exec_t:s0
/lib/ld-linux.so.2 system_u:object_r:lib_t:s0 -> system_u:object_r:ld_so_t:s0
</syntaxhighlight>

====== nftables config: ======
<syntaxhighlight lang="bash">
#!/usr/sbin/nft -f

flush ruleset

table inet filter {

# = Main chain policy =
chain input {
type filter hook input priority 0;
policy drop;

# = Common rule set =
# 🌀 Allow loopback interface (internal system processes)
iif "lo" accept

# == 🔁 Allow established and related connections ==
ct state established,related accept

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# == 🔒 Limit the rate of NEW connections per source IP (basic anti-DDoS protection) ==
# If you experience issues with slow or failed page loads in your browser,
# try increasing the limit, for example:
# ip saddr 0.0.0.0/0 ct state new limit rate 50/second burst 100 packets accept
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == 🚫 Blocking SSDP and mDNS (local broadcast discovery protocols) ==
ip daddr 239.255.255.250 udp dport 1900 drop # ❌ SSDP (UPnP/device discovery)
ip daddr 224.0.0.251 udp dport 5353 drop # ❌ mDNS (Bonjour, Avahi)

# == 🛑 Blocking NetBIOS and LLMNR (Windows/systemd internal LAN protocols) ==
udp dport 137 drop # ❌ NetBIOS Name Service (Windows network names)
udp dport 138 drop # ❌ NetBIOS Datagram Service (LAN name discovery)
udp dport 5355 drop # ❌ LLMNR (Link-Local Multicast Name Resolution)

# = Set of blocked IP addresses and ranges =

# == 🧱 Blocking known botnets and proxy networks ==
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} log prefix "🔥 BAN: known bots " flags all
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} drop

# == 🚫 Blocking strange TCP flags (XMAS, NULL scans and others) ==
tcp flags & (fin|syn|rst|psh|ack|urg) == 0 drop # NULL scan
tcp flags & (fin|psh|urg) == (fin|psh|urg) drop # XMAS scan
tcp flags & (fin|syn) == (fin|syn) drop # SYN-ACK scan
tcp flags & (syn|rst|fin) == (syn|rst|fin) drop # Xmas scan
tcp flags & (syn|fin|rst|psh|ack) == (syn|rst|fin|ack) drop # Xmas scan

# == 🚫 Blocking fragmented packets — commonly used in filter evasion ==
ip frag-off & 0x1fff != 0 drop

# == 🔒 Blocking spoofed IP packets ==
ip saddr 127.0.0.0/8 drop # localhost
ip saddr 10.0.0.0/8 drop # private network
ip saddr 172.16.0.0/12 drop # private network
ip saddr 192.168.0.0/16 drop # private network
ip saddr 169.254.0.0/16 drop # APIPA
ip saddr 0.0.0.0/8 drop # invalid address
ip saddr 224.0.0.0/4 drop # multicast
ip saddr 240.0.0.0/5 drop # reserved
}

# = Main chain policy =
chain forward {
type filter hook forward priority 0;
policy accept;

# = Blocking various types of attacks =
# Required in chain forward only if Docker or Oracle VirtualBox is present.
# If needed — uncomment.

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
# ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
# ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
# ip protocol icmp icmp type echo-request limit rate 1/second accept
# ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
# ip protocol icmp icmp type echo-request drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports required for application operation ==
tcp dport {
53, # DNS — needed for domain name resolution
80, # HTTP — web traffic, updates and resource loading
443, # HTTPS — secure web traffic, VPN, browser
12043, # Custom 3D Application — specific client port
13000-13050 # Custom 3D Application — dynamic client port range
} accept

# == Allow UDP ports required for application operation ==
udp dport {
53, # DNS — needed for domain name resolution
443, # HTTPS via QUIC/HTTP3, browser protocols
3478, # STUN/TURN — WebRTC and video calls
3479-3481 # STUN/TURN — WebRTC and video calls
} accept

# = Blocking dangerous and unnecessary TCP/UDP ports and ranges =

# These blocklists are intended for a DESKTOP / workstation.
# They block remote access, outdated services, proxies, DBs, IoT, and ports
# often used by malware, scanners, and C2 infrastructures.
#
# ⚠ If you use the system as a SERVER, enable IP forwarding,
# or run services with internal routing
# (Docker NAT/bridge, VirtualBox host-only/bridged, VPN clients),
# carefully review the blocked ports/ranges in the forward chain —
# these services may need extra ports.
# Adjust or comment out required items if necessary.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high risk) ===
22, # SSH — common brute-force target
23, # Telnet — outdated, no encryption
3389, # RDP — Windows remote desktop
5900, # VNC — remote access, frequent vulnerabilities
# === FTP / SMB / NetBIOS (unsafe file-sharing protocols) ===
21, # FTP — insecure protocol
137, # NetBIOS Name Service
138, # NetBIOS Datagram
139, # NetBIOS Session
445, # SMB/CIFS — common exploit target
# === Databases (NEVER expose to the Internet) ===
3306, # MySQL/MariaDB
1433, # MS SQL Server
1434, # MS SQL Browser
# === HTTP-alt/Proxy/Elasticsearch (exploited frequently) ===
8080, # HTTP proxy / web interfaces — often exposed accidentally
9200, # Elasticsearch API — full remote data access
# === UPnP/IoT (insecure by design) ===
1900, # SSDP / UPnP
# === Common for malware (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell
5555, # Android ADB / IoT botnets
9001, # Tor transport (used by malware)
1234, # Netcat / reverse connections
1337, # Common C2 port used by malware
# === ⚠️ Scanner ports and potentially vulnerable services ===
1080, # SOCKS proxy — used to bypass filtering
3128, # Squid proxy — may be abused as open proxy
8000, # Alternative HTTP ports, dev servers
8888, # Web interfaces, proxies, dev tools
10000 # Webmin — remote admin panel, frequent attacks
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; abused by attackers
162 # SNMP Trap — also potentially vulnerable
} drop

# Attention! Blocking wide port ranges — be careful!
# Do not break system or application functionality!

# == TCP port ranges not used by a workstation during transit routing ==
# Blocked to prevent unwanted forwarding, hidden tunnels,
# NAT evasion, parasitic flows, and potential forward-path attacks.

tcp dport {
1024-2047, # System/legacy services; rarely needed in forward
2048-4095, # Proprietary daemons; NFS (2049) — check if used
4096-8191, # Old VPNs, some games, P2P; rarely needed on desktop
8192-12287, # Alternative HTTP/proxy, multimedia; test as needed
12288-16383, # Media/VoIP (TCP fallback); may break calls
16384-24575, # RTP/WebRTC (TCP fallback); block unless AV needed
24576-32767, # Dynamic ranges for games/VPN; may cause issues
32768-49151, # Registered/ephemeral; risky — may break NAT, Docker, VM
49152-65535 # High ephemeral; widely used by modern apps
} drop

# == 🚫 Blocking UDP ports — high and dynamic ranges ==
udp dport {
1024-9999, # low/mid ephemeral ports; used by trojans, P2P, games, VPN
10000-65535 # high ephemeral; used by dynamic apps, VPN, Docker
} drop

# = 🕷️ Suspicious IPs — large ranges often used by botnets, spam nets, and scanners =
ip saddr {
185.0.0.0/8, # abused hosting and proxy networks
37.0.0.0/8, # cheap VPS, frequent scanning sources
88.0.0.0/8, # common brute-force and scanner range
77.0.0.0/8, # TOR/proxy nodes
91.0.0.0/8 # botnets and “grey-zone” hosting
} drop
}

chain output {
# = Main chain policy =
type filter hook output priority 0;
policy accept;

# = Blocking various types of attacks =

# == 🔒 Limiting new connections from a single IP (anti-DDoS) ==
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# = ICMP protocol restrictions =

# == 🛡️ Ping limitation ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == Critically important ICMP for network ==
ip protocol icmp icmp type { destination-unreachable, time-exceeded, parameter-problem } accept

# == Important ICMPv6 for IPv6 ==
ip6 nexthdr icmpv6 icmpv6 type { 1, 2, 3, 4 } accept
ip6 nexthdr icmpv6 icmpv6 type { 135, 136 } accept # NS/NA
ip6 nexthdr icmpv6 icmpv6 type { 133, 134 } accept # RS/RA

# == Drop all other ICMP and ICMPv6 ==
ip protocol icmp drop # drop all other ICMP
ip6 nexthdr icmpv6 drop # drop all other ICMPv6

# = SCTP protocol blocking =
# 99.9% of desktop systems do not use SCTP at all
meta l4proto sctp drop

# = DCCP — Datagram Congestion Control Protocol blocking =
# Not used by any mainstream desktop applications
meta l4proto dccp drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports and ranges required for application functionality ==
tcp dport {
53, # DNS client. Required for Internet to work: domain name resolution (UDP/TCP).
80, # HTTP traffic to unencrypted websites; apps may use it for API/redirects.
443, # HTTPS. Main port for all encrypted web traffic — browsers, API, VPN, updates.
3306, # MySQL client. Needed if you connect to MySQL.
3478, # STUN/TURN WebRTC. Needed for audio/video/Discord.
3000, # Node.js dev servers. Needed for development.
3690, # SVN. If you work with an old repository.
4443, # Alternative HTTPS (some APIs). Also used by some VPN/clients.
12043, # Required for Custom 3D Application.
13000-13050 # Required for Custom 3D Application.
} accept

# == Allow UDP ports and ranges required for applications ==
udp dport {
443, # Required for fast and stable operation of modern websites
# (Google, YouTube, ChatGPT, Cloudflare)
13000-13050 # Required for Custom 3D Application.
} accept

# = Blocking potentially dangerous / unnecessary TCP/UDP ports =

# These blocks are intended for a DESKTOP / workstation.
# ⚠ If you use the system as a SERVER —
# adjust or comment out the required ports/ranges as needed.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high-risk) ===
22, # SSH — target of brute-force attacks.
23, # Telnet — outdated, unencrypted.
3389, # RDP — Windows remote access.
5900, # VNC — remote access, often vulnerable.
# === FTP / SMB / NetBIOS (dangerous file-sharing services) ===
21, # FTP — insecure protocol.
137, # NetBIOS Name Service.
138, # NetBIOS Datagram.
139, # NetBIOS Session.
445, # SMB/CIFS — frequent exploitation target.
# === Databases (NEVER open to the Internet) ===
3306, # MySQL/MariaDB.
1433, # MS SQL Server.
1434, # MS SQL Browser.
# === HTTP-alt/Proxy/Elasticsearch (dangerous, often attacked) ===
8080, # HTTP proxy / web interfaces — often exposed test interfaces.
9200, # Elasticsearch API — full remote access to data.
# === UPnP/IoT (vulnerable by design) ===
1900, # SSDP / UPnP.
# === Common malware ports (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell.
5555, # Android ADB / IoT botnets.
9001, # Tor transport (used by malware).
1234, # Netcat / reverse connections.
1337, # Common C2 malware port.
# === ⚠️ Ports of scanners and potentially vulnerable services ===
1080, # SOCKS proxy — often abused for bypassing filters.
3128, # Squid HTTP proxy — can be used as open proxy.
8000, # Alternative HTTP ports, web services — potentially vulnerable.
8888, # Alternative web interfaces — test and proxy ports.
10000 # Webmin — web admin panel, target of attacks.
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; can be abused by attackers.
162 # SNMP Trap — same, potential vulnerability.
} drop

# Warning! ⚠️ Be careful blocking wide port ranges! ⚠️
# Do not break system or application functionality!
# If you need a range — uncomment.
# If you don’t — comment out.

# == Blocking “dangerous” and desktop-unnecessary TCP port ranges ==
tcp dport {
1-1023, # 🛑 Privileged ports.
1024-2047, # r-commands (rlogin, rsh, rexec), old RPC, NFS, legacy daemons.
2048-3071, # Rare proprietary protocols and middleware.
3072-4999, # Mostly ports of legacy, server, corporate apps;
# rarely needed on workstations.
5000-5999, # Alternative services, old P2P/admin ports, rarely used on desktops.
7000-7999, # Alternative/test ports, often used by trojans.
9000-9999, # Web services, proxies, possible backdoor ports.
10000-19998, # Dynamic/high service ports; may be required by some apps like Custom 3D Application,
# but not needed by most desktop services.
19999-32767 # Old ephemeral port range; used by P2P, games, some VPNs,
# but system services rarely use them.
} drop

# == Blocking “dangerous” and desktop-unnecessary UDP port ranges ==
udp dport {
1024-2047, # Old UNIX services, RPC, NFS, r-commands, legacy daemons.
# Usually safe to block.
2048-4095, # Rarely used standard ports, proprietary services.
# Usually safe to block.
4096-8191, # VPN, games, P2P, WebRTC, VoIP of some clients.
# Can block, but cautiously: may affect VPN/apps.
8192-12287, # QUIC/HTTP3, proxies, multimedia protocols.
# Might cause side effects; better test first.
12288-16383, # Old RTP/VoIP ranges and media streams.
# Can block, but might break video calls.
16384-24575, # Main RTP range (audio/video), WebRTC, VoIP.
# ❗ Do not block if you need video calls/WebRTC/VPN.
24576-32767 # Dynamic ports for VPN, P2P, games, streaming data.
# ❗ May break VPN or some apps.
} drop

# == 🕷️ Blocking suspicious IPs —
# large ranges often used by botnets, spam networks, and scanners ==
ip saddr {
185.0.0.0/8, # Abused hosting and proxy networks.
37.0.0.0/8, # Cheap VPS, scanning sources.
88.0.0.0/8, # Frequent brute-force and scanners.
77.0.0.0/8, # Massive TOR/proxy nodes.
91.0.0.0/8 # Botnets and “grey” hosting.
} drop
}
}

</syntaxhighlight>

====== sysctl config: ======
kernel parameters configuration

/etc/sysctl.d/99-protect.conf<syntaxhighlight lang="bash">
# 1 Ignore ICMP on interfaces
net.ipv4.icmp_echo_ignore_all = 1

# 2 Do not respond to ICMP broadcast (against Smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 3 Enable SYN backlog reduction
net.ipv4.tcp_syncookies = 1

# 4 Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 5 Log packets with incorrect routing
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# 6 Disable ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# 7 Disable packet forwarding
net.ipv4.ip_forward = 0

# 8 Disable IPv6 support
net.ipv4.conf.all.disable_ipv6 = 1
net.ipv4.conf.default.disable_ipv6 = 1

# 9 Prevent sending TCP segments with null windows
net.ipv4.tcp_rfc1337 = 1

# 10 Disable ARP filtering for automatic routing
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1

# 11 Limit the maximum size of the incoming TCP window
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# 12 Drop packets with incorrect checksums
net.ipv4.conf.all.drop_unicast_in_l2_multicast = 1
net.ipv4.conf.default.drop_unicast_in_l2_multicast = 1

# 13 Disable IPv6 forwarding
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# 14 Limit the maximum number of SYN packet retries
net.ipv4.tcp_synack_retries = 2

# 15 Increase routing cache lifetime
net.ipv4.route.max_size = 32768
</syntaxhighlight>

====== auditd rules config: ======
/etc/audit/rules.d/audit.rules

<syntaxhighlight lang="bash">
## Flush rules
-D

## Buffers
-b 8192
--backlog_wait_time 60000
-f 1

## Network audit
-a always,exit -F arch=b64 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b64 -S accept4 -F success=1 -k network_accept
-a always,exit -F arch=b32 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b32 -S accept4 -F success=1 -k network_accept

## Logging execve commands
-a always,exit -F arch=b64 -S execve -F key=exec_log

## Audit logins and sessions
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session

## sudo / su
-w /etc/sudoers -p wa -k sudo
-w /etc/sudoers.d/ -p wa -k sudo
-w /bin/su -p x -k su_cmd

## Account and configuration changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/hosts -p wa -k system_conf
-w /etc/hostname -p wa -k system_conf
-w /etc/resolv.conf -p wa -k system_conf
-w /etc/issue -p wa -k system_conf
-w /etc/network/ -p wa -k system_conf

## Time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -F key=time_change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -F key=time_change

## Audit SSH connections and changes
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /var/log/auth.log -p wa -k ssh_login

## Audit usage of remote tools (e.g., SSH, netcat)
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/nc -k nc_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/nc -k nc_process

## Audit privileged access
-a always,exit -F arch=b64 -S setuid -S setgid -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -S setgid -k privilege_escalation
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/sudoers.d/ -p wa -k sudoers_changes
-w /bin/sudo -p x -k sudo_command

## Monitor credential changes
#-w /root/.ssh/ -p wa -k ssh_keys
#-w /home/*/.ssh/ -p wa -k ssh_keys

## Audit use of remote network services
-a always,exit -F arch=b64 -S socket -F success=1 -k socket_connect
-a always,exit -F arch=b32 -S socket -F success=1 -k socket_connect

# Log package installation and removal via dpkg
-w /usr/bin/dpkg -p x
-w /usr/sbin/apt-get -p x
-w /usr/bin/apt -p x
</syntaxhighlight>

==== UsefulPrograms ====

Here is the list of programs useful for configuring and maintaining the security of Linux systems. The included programs are either open-source (the majority) or commercial, but with freely available limited features sufficient to address core security tasks (a smaller portion).

https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/UsefulPrograms

==== External Resources ====

[https://www.debian.org/doc/manuals/securing-debian-manual/index.en.html|Securing Debian Manual 3.19 — Javier Fernández-Sanguino Peña.]
This document describes security in the Debian project and in the Debian operating system. Starting with the process of securing and hardening the default Debian GNU/Linux distribution installation, it also covers some of the common tasks to set up a secure network environment using Debian GNU/Linux, gives additional information on the security tools available and talks about how security is enforced in Debian by the security and audit team.

[https://medium.com/%40ihouelecaurcy/the-complete-nftables-guide-modern-linux-firewall-mastery-79fb86894d5c|The Complete nftables Guide: Modern Linux Firewall Mastery — Ihouele Caurcy]
The definitive guide to nftables — the modern replacement for iptables, ip6tables, arptables, and ebtables. From basic concepts to enterprise-level configurations.

[https://notes.suhaib.in/docs/tech/utilities/iptables-nftables-and-you-a-friendly-guide-to-traffic-rules/|iptables, nftables, and You A Friendly Guide to Traffic Rules]
A friendly guide to iptables and nftables in Linux: explains Netfilter architecture, tables, chains and rules, with configuration examples (SSH, IP blocking, port forwarding). Covers differences between iptables and nftables, migration, and compatibility with modern firewall tools. Useful for understanding the iptables→nftables transition and practical examples.

[https://public.jdstone1.com/books_and_magazines/Computer_Books/Operating_Systems/SELinux%20System%20Administration%20(3rd%20ed).pdf|SELinux System Administration Third Edition — Sven Vermeulen.]
Implement mandatory access control to secure applications, users, and information flows on Linux.

[https://gitlab.com/apparmor/apparmor/-/wikis/home AppArmor]
The official wiki for the AppArmor security project on Linux. Provides guidance for users and developers, instructions for creating and managing security profiles, example access policies for applications, and best practices to protect the operating system.

[https://nallino.net/stockage/security/Linux_Mint_Security.pdf|Security, Privacy and Anonymity in Linux Mint — Michel Nallino.]
A good and comprehensive work on Linux Mint security that can also be useful for other Linux distributions.

[https://www.cisa.gov/topics/cybersecurity-best-practices|CISA — Cybersecurity Best Practices]
CISA (Certified Information Systems Auditor) provides information on cybersecurity best practices to help individuals and organizations implement preventative measures and manage cyber risks.

This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131,
it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks

[[index.php?title=Category:Security]]
[[index.php?title=Category:Hardening]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2025-12-16T17:39:48Z

Blackcat568: /* Linux system hardening recommendations: */

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.

* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

===== Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build). =====
Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

# 1. Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.
# If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to type long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>
# Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.
# Avoid using the superuser account or sudo without a clear necessity — and never execute arbitrary scripts with sudo. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
## Always read a script fully before running it (less script.sh, cat script.sh).
## Never paste commands from untrusted or unverified sources into the terminal.
## Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
## Follow the principle of least privilege — create separate user accounts and limit access rights where possible Important: Improper or careless use of sudo and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.
# Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. You may also consider switching to SELinux. If you have difficulty configuring AppArmor or SELinux, seek help from specialists or use AI-based tools. My SELinux configuration is attached below (I use SELinux on Debian 12 — it works reliably).
# Use advanced network filtering settings: iptables or nftables, or a commercial firewall. (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#nftables config:|nftables config]]
# Configure kernel parameters for maximum security (sysctl hardening). (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#sysctl config:|sysctl config]])
# Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event). (sample [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#auditd rules config:|auditd rules config]]
# Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.
# If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.
# Follow the principle of Attack Surface Reduction (or [https://en.wikipedia.org/wiki/Occam's_razor Occam's Razor]) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
## If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
## If you are certain you will never use it, remove it completely from the system.
## This practice reduces potential attack vectors and strengthens overall system security.
## Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications. Always create a full system backup before making any significant configuration changes or modifications.
# Perform regular antivirus and anti-rootkit scans of the system. In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.
# Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:
<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

'''Related Aspects of Internet Security'''

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

1. Store passwords in a reliable password manager.

'''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:

* relying on human memory, with the risk of forgetting or confusing credentials;
* storing passwords on paper media, which can be damaged, lost, or stolen;
* saving passwords in web browsers in unencrypted form;
* keeping passwords in plain text files on the desktop or in other directories without encryption;
* and similar approaches.

Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.

A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.

* Regularly create up-to-date backups of the ''encrypted'' password database.

* Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.

Additional Practical Recommendations

A password manager (for example, KeePassXC) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.

In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.

It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).

2. Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [[wikipedia:Authenticator_app|Authenticator_app]]), or a hardware security key such as a [[wikipedia:YubiKey|YubiKey]].

This is a critical cybersecurity measure — neglecting it can completely undermine all your efforts in configuring a secure Linux system.

The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:

* YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
* It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
* Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number. For now, it is one of the most reliable hardware-based options for two-factor authentication.

3. Using VPN to improve privacy and security

''If you are a private user'', you can also configure a system-wide VPN (for example, ProtonVPN) so that all device traffic is routed through it — not only browser traffic or traffic from specific applications.

Enable the “killswitch” mode and disable it only when necessary, re-enabling it immediately afterwards.

It is also recommended to periodically change VPN servers, doing so at different and unpredictable intervals.

Using a VPN increases your privacy: all of your traffic will be encrypted from observers on your local network and from your internet service provider. This makes it more difficult for an attacker to apply certain social-engineering methods based on traffic analysis, and it also helps protect your privacy in the event that your provider’s infrastructure is compromised.

''If you own a server'' and want access to it to be available only to trusted private or legal entities, while also increasing its protection against unauthorized access, you can configure the server so that SSH and other internal services are accessible exclusively through OpenVPN using TLS authentication (tls-auth / tls-crypt) and unique client certificates instead of passwords.

4. Actively study and apply artificial intelligence to improve security configurations in Debian and other Linux distributions, as well as to address related cybersecurity tasks. A lack of knowledge often becomes the weakest link; AI can provide accurate, structured recommendations interactively and help automate repetitive or complex operations.

5. If privacy is a priority, consider reducing reliance on the Google ecosystem and switching to more privacy-focused alternatives (for example, proton.me and similar services). Google provides very strong security, but its services collect extensive telemetry for analysis. While this data is encrypted and not accessible to attackers, it may still be undesirable for users who value strict privacy.

''Always verify AI-generated recommendations before applying them in production environments. Test any changes in an isolated system, review generated commands or configurations, and ensure that suggestions align with your threat model and security architecture.''

''In practice, users who effectively leverage AI tools are significantly better prepared, and the adoption of such technologies makes malicious activity considerably more difficult for attackers.''

'''''Note:''' Artificial intelligence tools are mentioned here as optional technical aids, not as an endorsement of any specific service or vendor.''

6. It is also important to consider the possibility of hardware-level attacks.

Although such attacks are significantly less common and typically require more resources than software-based attacks, they remain a potential threat. In certain scenarios, an adversary may exploit vulnerabilities in device firmware or conduct a combined attack targeting both software and hardware layers. Examples include remote injection of malicious code into the firmware of a motherboard, router, optical modem, or other hardware components.

If, after a thorough software-level audit, a security issue remains unresolved, it is advisable <nowiki>'''</nowiki>to perform a hardware-level assessment<nowiki>'''</nowiki> as well, including verification of device firmware integrity and configuration.

<blockquote>'''And most importantly — give up the illusion of complete security. We live in conditions of a severe information war, and everyone must make efforts so that malicious actors cannot freely spy on desktops and servers.'''</blockquote>

'''Examples of Deep Custom Security Configurations'''

Below are examples of strong, individualized configurations for '''SELinux''', '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

====== SELinux config: ======
<syntaxhighlight lang="terminfo">
root@user:/home/user# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
root@user:/home/user# sestatus -v
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

Process contexts:
Current context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Init context: system_u:system_r:init_t:s0
/sbin/agetty system_u:system_r:getty_t:s0

File contexts:
Controlling terminal: unconfined_u:object_r:user_devpts_t:s0
/etc/passwd system_u:object_r:etc_t:s0
/etc/shadow system_u:object_r:unlabeled_t:s0
/bin/bash system_u:object_r:shell_exec_t:s0
/bin/login system_u:object_r:login_exec_t:s0
/bin/sh system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0
/sbin/agetty system_u:object_r:getty_exec_t:s0
/sbin/init system_u:object_r:bin_t:s0 -> system_u:object_r:init_exec_t:s0
/lib/ld-linux.so.2 system_u:object_r:lib_t:s0 -> system_u:object_r:ld_so_t:s0
</syntaxhighlight>

====== nftables config: ======
<syntaxhighlight lang="bash">
#!/usr/sbin/nft -f

flush ruleset

table inet filter {

# = Main chain policy =
chain input {
type filter hook input priority 0;
policy drop;

# = Common rule set =
# 🌀 Allow loopback interface (internal system processes)
iif "lo" accept

# == 🔁 Allow established and related connections ==
ct state established,related accept

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# == 🔒 Limit the rate of NEW connections per source IP (basic anti-DDoS protection) ==
# If you experience issues with slow or failed page loads in your browser,
# try increasing the limit, for example:
# ip saddr 0.0.0.0/0 ct state new limit rate 50/second burst 100 packets accept
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == 🚫 Blocking SSDP and mDNS (local broadcast discovery protocols) ==
ip daddr 239.255.255.250 udp dport 1900 drop # ❌ SSDP (UPnP/device discovery)
ip daddr 224.0.0.251 udp dport 5353 drop # ❌ mDNS (Bonjour, Avahi)

# == 🛑 Blocking NetBIOS and LLMNR (Windows/systemd internal LAN protocols) ==
udp dport 137 drop # ❌ NetBIOS Name Service (Windows network names)
udp dport 138 drop # ❌ NetBIOS Datagram Service (LAN name discovery)
udp dport 5355 drop # ❌ LLMNR (Link-Local Multicast Name Resolution)

# = Set of blocked IP addresses and ranges =

# == 🧱 Blocking known botnets and proxy networks ==
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} log prefix "🔥 BAN: known bots " flags all
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} drop

# == 🚫 Blocking strange TCP flags (XMAS, NULL scans and others) ==
tcp flags & (fin|syn|rst|psh|ack|urg) == 0 drop # NULL scan
tcp flags & (fin|psh|urg) == (fin|psh|urg) drop # XMAS scan
tcp flags & (fin|syn) == (fin|syn) drop # SYN-ACK scan
tcp flags & (syn|rst|fin) == (syn|rst|fin) drop # Xmas scan
tcp flags & (syn|fin|rst|psh|ack) == (syn|rst|fin|ack) drop # Xmas scan

# == 🚫 Blocking fragmented packets — commonly used in filter evasion ==
ip frag-off & 0x1fff != 0 drop

# == 🔒 Blocking spoofed IP packets ==
ip saddr 127.0.0.0/8 drop # localhost
ip saddr 10.0.0.0/8 drop # private network
ip saddr 172.16.0.0/12 drop # private network
ip saddr 192.168.0.0/16 drop # private network
ip saddr 169.254.0.0/16 drop # APIPA
ip saddr 0.0.0.0/8 drop # invalid address
ip saddr 224.0.0.0/4 drop # multicast
ip saddr 240.0.0.0/5 drop # reserved
}

# = Main chain policy =
chain forward {
type filter hook forward priority 0;
policy accept;

# = Blocking various types of attacks =
# Required in chain forward only if Docker or Oracle VirtualBox is present.
# If needed — uncomment.

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
# ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
# ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
# ip protocol icmp icmp type echo-request limit rate 1/second accept
# ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
# ip protocol icmp icmp type echo-request drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports required for application operation ==
tcp dport {
53, # DNS — needed for domain name resolution
80, # HTTP — web traffic, updates and resource loading
443, # HTTPS — secure web traffic, VPN, browser
12043, # Custom 3D Application — specific client port
13000-13050 # Custom 3D Application — dynamic client port range
} accept

# == Allow UDP ports required for application operation ==
udp dport {
53, # DNS — needed for domain name resolution
443, # HTTPS via QUIC/HTTP3, browser protocols
3478, # STUN/TURN — WebRTC and video calls
3479-3481 # STUN/TURN — WebRTC and video calls
} accept

# = Blocking dangerous and unnecessary TCP/UDP ports and ranges =

# These blocklists are intended for a DESKTOP / workstation.
# They block remote access, outdated services, proxies, DBs, IoT, and ports
# often used by malware, scanners, and C2 infrastructures.
#
# ⚠ If you use the system as a SERVER, enable IP forwarding,
# or run services with internal routing
# (Docker NAT/bridge, VirtualBox host-only/bridged, VPN clients),
# carefully review the blocked ports/ranges in the forward chain —
# these services may need extra ports.
# Adjust or comment out required items if necessary.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high risk) ===
22, # SSH — common brute-force target
23, # Telnet — outdated, no encryption
3389, # RDP — Windows remote desktop
5900, # VNC — remote access, frequent vulnerabilities
# === FTP / SMB / NetBIOS (unsafe file-sharing protocols) ===
21, # FTP — insecure protocol
137, # NetBIOS Name Service
138, # NetBIOS Datagram
139, # NetBIOS Session
445, # SMB/CIFS — common exploit target
# === Databases (NEVER expose to the Internet) ===
3306, # MySQL/MariaDB
1433, # MS SQL Server
1434, # MS SQL Browser
# === HTTP-alt/Proxy/Elasticsearch (exploited frequently) ===
8080, # HTTP proxy / web interfaces — often exposed accidentally
9200, # Elasticsearch API — full remote data access
# === UPnP/IoT (insecure by design) ===
1900, # SSDP / UPnP
# === Common for malware (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell
5555, # Android ADB / IoT botnets
9001, # Tor transport (used by malware)
1234, # Netcat / reverse connections
1337, # Common C2 port used by malware
# === ⚠️ Scanner ports and potentially vulnerable services ===
1080, # SOCKS proxy — used to bypass filtering
3128, # Squid proxy — may be abused as open proxy
8000, # Alternative HTTP ports, dev servers
8888, # Web interfaces, proxies, dev tools
10000 # Webmin — remote admin panel, frequent attacks
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; abused by attackers
162 # SNMP Trap — also potentially vulnerable
} drop

# Attention! Blocking wide port ranges — be careful!
# Do not break system or application functionality!

# == TCP port ranges not used by a workstation during transit routing ==
# Blocked to prevent unwanted forwarding, hidden tunnels,
# NAT evasion, parasitic flows, and potential forward-path attacks.

tcp dport {
1024-2047, # System/legacy services; rarely needed in forward
2048-4095, # Proprietary daemons; NFS (2049) — check if used
4096-8191, # Old VPNs, some games, P2P; rarely needed on desktop
8192-12287, # Alternative HTTP/proxy, multimedia; test as needed
12288-16383, # Media/VoIP (TCP fallback); may break calls
16384-24575, # RTP/WebRTC (TCP fallback); block unless AV needed
24576-32767, # Dynamic ranges for games/VPN; may cause issues
32768-49151, # Registered/ephemeral; risky — may break NAT, Docker, VM
49152-65535 # High ephemeral; widely used by modern apps
} drop

# == 🚫 Blocking UDP ports — high and dynamic ranges ==
udp dport {
1024-9999, # low/mid ephemeral ports; used by trojans, P2P, games, VPN
10000-65535 # high ephemeral; used by dynamic apps, VPN, Docker
} drop

# = 🕷️ Suspicious IPs — large ranges often used by botnets, spam nets, and scanners =
ip saddr {
185.0.0.0/8, # abused hosting and proxy networks
37.0.0.0/8, # cheap VPS, frequent scanning sources
88.0.0.0/8, # common brute-force and scanner range
77.0.0.0/8, # TOR/proxy nodes
91.0.0.0/8 # botnets and “grey-zone” hosting
} drop
}

chain output {
# = Main chain policy =
type filter hook output priority 0;
policy accept;

# = Blocking various types of attacks =

# == 🔒 Limiting new connections from a single IP (anti-DDoS) ==
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# = ICMP protocol restrictions =

# == 🛡️ Ping limitation ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == Critically important ICMP for network ==
ip protocol icmp icmp type { destination-unreachable, time-exceeded, parameter-problem } accept

# == Important ICMPv6 for IPv6 ==
ip6 nexthdr icmpv6 icmpv6 type { 1, 2, 3, 4 } accept
ip6 nexthdr icmpv6 icmpv6 type { 135, 136 } accept # NS/NA
ip6 nexthdr icmpv6 icmpv6 type { 133, 134 } accept # RS/RA

# == Drop all other ICMP and ICMPv6 ==
ip protocol icmp drop # drop all other ICMP
ip6 nexthdr icmpv6 drop # drop all other ICMPv6

# = SCTP protocol blocking =
# 99.9% of desktop systems do not use SCTP at all
meta l4proto sctp drop

# = DCCP — Datagram Congestion Control Protocol blocking =
# Not used by any mainstream desktop applications
meta l4proto dccp drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports and ranges required for application functionality ==
tcp dport {
53, # DNS client. Required for Internet to work: domain name resolution (UDP/TCP).
80, # HTTP traffic to unencrypted websites; apps may use it for API/redirects.
443, # HTTPS. Main port for all encrypted web traffic — browsers, API, VPN, updates.
3306, # MySQL client. Needed if you connect to MySQL.
3478, # STUN/TURN WebRTC. Needed for audio/video/Discord.
3000, # Node.js dev servers. Needed for development.
3690, # SVN. If you work with an old repository.
4443, # Alternative HTTPS (some APIs). Also used by some VPN/clients.
12043, # Required for Custom 3D Application.
13000-13050 # Required for Custom 3D Application.
} accept

# == Allow UDP ports and ranges required for applications ==
udp dport {
443, # Required for fast and stable operation of modern websites
# (Google, YouTube, ChatGPT, Cloudflare)
13000-13050 # Required for Custom 3D Application.
} accept

# = Blocking potentially dangerous / unnecessary TCP/UDP ports =

# These blocks are intended for a DESKTOP / workstation.
# ⚠ If you use the system as a SERVER —
# adjust or comment out the required ports/ranges as needed.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high-risk) ===
22, # SSH — target of brute-force attacks.
23, # Telnet — outdated, unencrypted.
3389, # RDP — Windows remote access.
5900, # VNC — remote access, often vulnerable.
# === FTP / SMB / NetBIOS (dangerous file-sharing services) ===
21, # FTP — insecure protocol.
137, # NetBIOS Name Service.
138, # NetBIOS Datagram.
139, # NetBIOS Session.
445, # SMB/CIFS — frequent exploitation target.
# === Databases (NEVER open to the Internet) ===
3306, # MySQL/MariaDB.
1433, # MS SQL Server.
1434, # MS SQL Browser.
# === HTTP-alt/Proxy/Elasticsearch (dangerous, often attacked) ===
8080, # HTTP proxy / web interfaces — often exposed test interfaces.
9200, # Elasticsearch API — full remote access to data.
# === UPnP/IoT (vulnerable by design) ===
1900, # SSDP / UPnP.
# === Common malware ports (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell.
5555, # Android ADB / IoT botnets.
9001, # Tor transport (used by malware).
1234, # Netcat / reverse connections.
1337, # Common C2 malware port.
# === ⚠️ Ports of scanners and potentially vulnerable services ===
1080, # SOCKS proxy — often abused for bypassing filters.
3128, # Squid HTTP proxy — can be used as open proxy.
8000, # Alternative HTTP ports, web services — potentially vulnerable.
8888, # Alternative web interfaces — test and proxy ports.
10000 # Webmin — web admin panel, target of attacks.
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; can be abused by attackers.
162 # SNMP Trap — same, potential vulnerability.
} drop

# Warning! ⚠️ Be careful blocking wide port ranges! ⚠️
# Do not break system or application functionality!
# If you need a range — uncomment.
# If you don’t — comment out.

# == Blocking “dangerous” and desktop-unnecessary TCP port ranges ==
tcp dport {
1-1023, # 🛑 Privileged ports.
1024-2047, # r-commands (rlogin, rsh, rexec), old RPC, NFS, legacy daemons.
2048-3071, # Rare proprietary protocols and middleware.
3072-4999, # Mostly ports of legacy, server, corporate apps;
# rarely needed on workstations.
5000-5999, # Alternative services, old P2P/admin ports, rarely used on desktops.
7000-7999, # Alternative/test ports, often used by trojans.
9000-9999, # Web services, proxies, possible backdoor ports.
10000-19998, # Dynamic/high service ports; may be required by some apps like Custom 3D Application,
# but not needed by most desktop services.
19999-32767 # Old ephemeral port range; used by P2P, games, some VPNs,
# but system services rarely use them.
} drop

# == Blocking “dangerous” and desktop-unnecessary UDP port ranges ==
udp dport {
1024-2047, # Old UNIX services, RPC, NFS, r-commands, legacy daemons.
# Usually safe to block.
2048-4095, # Rarely used standard ports, proprietary services.
# Usually safe to block.
4096-8191, # VPN, games, P2P, WebRTC, VoIP of some clients.
# Can block, but cautiously: may affect VPN/apps.
8192-12287, # QUIC/HTTP3, proxies, multimedia protocols.
# Might cause side effects; better test first.
12288-16383, # Old RTP/VoIP ranges and media streams.
# Can block, but might break video calls.
16384-24575, # Main RTP range (audio/video), WebRTC, VoIP.
# ❗ Do not block if you need video calls/WebRTC/VPN.
24576-32767 # Dynamic ports for VPN, P2P, games, streaming data.
# ❗ May break VPN or some apps.
} drop

# == 🕷️ Blocking suspicious IPs —
# large ranges often used by botnets, spam networks, and scanners ==
ip saddr {
185.0.0.0/8, # Abused hosting and proxy networks.
37.0.0.0/8, # Cheap VPS, scanning sources.
88.0.0.0/8, # Frequent brute-force and scanners.
77.0.0.0/8, # Massive TOR/proxy nodes.
91.0.0.0/8 # Botnets and “grey” hosting.
} drop
}
}

</syntaxhighlight>

====== sysctl config: ======
kernel parameters configuration

/etc/sysctl.d/99-protect.conf<syntaxhighlight lang="bash">
# 1 Ignore ICMP on interfaces
net.ipv4.icmp_echo_ignore_all = 1

# 2 Do not respond to ICMP broadcast (against Smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 3 Enable SYN backlog reduction
net.ipv4.tcp_syncookies = 1

# 4 Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 5 Log packets with incorrect routing
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# 6 Disable ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# 7 Disable packet forwarding
net.ipv4.ip_forward = 0

# 8 Disable IPv6 support
net.ipv4.conf.all.disable_ipv6 = 1
net.ipv4.conf.default.disable_ipv6 = 1

# 9 Prevent sending TCP segments with null windows
net.ipv4.tcp_rfc1337 = 1

# 10 Disable ARP filtering for automatic routing
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1

# 11 Limit the maximum size of the incoming TCP window
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# 12 Drop packets with incorrect checksums
net.ipv4.conf.all.drop_unicast_in_l2_multicast = 1
net.ipv4.conf.default.drop_unicast_in_l2_multicast = 1

# 13 Disable IPv6 forwarding
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# 14 Limit the maximum number of SYN packet retries
net.ipv4.tcp_synack_retries = 2

# 15 Increase routing cache lifetime
net.ipv4.route.max_size = 32768
</syntaxhighlight>

====== auditd rules config: ======
/etc/audit/rules.d/audit.rules

<syntaxhighlight lang="bash">
## Flush rules
-D

## Buffers
-b 8192
--backlog_wait_time 60000
-f 1

## Network audit
-a always,exit -F arch=b64 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b64 -S accept4 -F success=1 -k network_accept
-a always,exit -F arch=b32 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b32 -S accept4 -F success=1 -k network_accept

## Logging execve commands
-a always,exit -F arch=b64 -S execve -F key=exec_log

## Audit logins and sessions
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session

## sudo / su
-w /etc/sudoers -p wa -k sudo
-w /etc/sudoers.d/ -p wa -k sudo
-w /bin/su -p x -k su_cmd

## Account and configuration changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/hosts -p wa -k system_conf
-w /etc/hostname -p wa -k system_conf
-w /etc/resolv.conf -p wa -k system_conf
-w /etc/issue -p wa -k system_conf
-w /etc/network/ -p wa -k system_conf

## Time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -F key=time_change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -F key=time_change

## Audit SSH connections and changes
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /var/log/auth.log -p wa -k ssh_login

## Audit usage of remote tools (e.g., SSH, netcat)
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/nc -k nc_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/nc -k nc_process

## Audit privileged access
-a always,exit -F arch=b64 -S setuid -S setgid -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -S setgid -k privilege_escalation
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/sudoers.d/ -p wa -k sudoers_changes
-w /bin/sudo -p x -k sudo_command

## Monitor credential changes
#-w /root/.ssh/ -p wa -k ssh_keys
#-w /home/*/.ssh/ -p wa -k ssh_keys

## Audit use of remote network services
-a always,exit -F arch=b64 -S socket -F success=1 -k socket_connect
-a always,exit -F arch=b32 -S socket -F success=1 -k socket_connect

# Log package installation and removal via dpkg
-w /usr/bin/dpkg -p x
-w /usr/sbin/apt-get -p x
-w /usr/bin/apt -p x
</syntaxhighlight>

==== UsefulPrograms ====

Here is the list of programs useful for configuring and maintaining the security of Linux systems. The included programs are either open-source (the majority) or commercial, but with freely available limited features sufficient to address core security tasks (a smaller portion).

https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/UsefulPrograms

==== External Resources ====

[https://www.debian.org/doc/manuals/securing-debian-manual/index.en.html|Securing Debian Manual 3.19 — Javier Fernández-Sanguino Peña.]
This document describes security in the Debian project and in the Debian operating system. Starting with the process of securing and hardening the default Debian GNU/Linux distribution installation, it also covers some of the common tasks to set up a secure network environment using Debian GNU/Linux, gives additional information on the security tools available and talks about how security is enforced in Debian by the security and audit team.

[https://medium.com/%40ihouelecaurcy/the-complete-nftables-guide-modern-linux-firewall-mastery-79fb86894d5c|The Complete nftables Guide: Modern Linux Firewall Mastery — Ihouele Caurcy]
The definitive guide to nftables — the modern replacement for iptables, ip6tables, arptables, and ebtables. From basic concepts to enterprise-level configurations.

[https://notes.suhaib.in/docs/tech/utilities/iptables-nftables-and-you-a-friendly-guide-to-traffic-rules/|iptables, nftables, and You A Friendly Guide to Traffic Rules]
A friendly guide to iptables and nftables in Linux: explains Netfilter architecture, tables, chains and rules, with configuration examples (SSH, IP blocking, port forwarding). Covers differences between iptables and nftables, migration, and compatibility with modern firewall tools. Useful for understanding the iptables→nftables transition and practical examples.

[https://public.jdstone1.com/books_and_magazines/Computer_Books/Operating_Systems/SELinux%20System%20Administration%20(3rd%20ed).pdf|SELinux System Administration Third Edition — Sven Vermeulen.]
Implement mandatory access control to secure applications, users, and information flows on Linux.

https://gitlab.com/apparmor/apparmor/-/wikis/home
The official wiki for the AppArmor security project on Linux. Provides guidance for users and developers, instructions for creating and managing security profiles, example access policies for applications, and best practices to protect the operating system.

[https://nallino.net/stockage/security/Linux_Mint_Security.pdf|Security, Privacy and Anonymity in Linux Mint — Michel Nallino.]
A good and comprehensive work on Linux Mint security that can also be useful for other Linux distributions.

[https://www.cisa.gov/topics/cybersecurity-best-practices|CISA — Cybersecurity Best Practices]
CISA (Certified Information Systems Auditor) provides information on cybersecurity best practices to help individuals and organizations implement preventative measures and manage cyber risks.

This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131,
it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks

[[index.php?title=Category:Security]]
[[index.php?title=Category:Hardening]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2025-12-16T17:30:58Z

Blackcat568: /* External Resources */

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.

* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

===== Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build). =====
Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

# 1. Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.
# If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to type long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>
# Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.
# Avoid using the superuser account or sudo without a clear necessity — and never execute arbitrary scripts with sudo. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
## Always read a script fully before running it (less script.sh, cat script.sh).
## Never paste commands from untrusted or unverified sources into the terminal.
## Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
## Follow the principle of least privilege — create separate user accounts and limit access rights where possible Important: Improper or careless use of sudo and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.
# Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. You may also consider switching to SELinux. If you have difficulty configuring AppArmor or SELinux, seek help from specialists or use AI-based tools. My SELinux configuration is attached below (I use SELinux on Debian 12 — it works reliably).
# Use advanced network filtering settings: iptables or nftables, or a commercial firewall. (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#nftables config:|nftables config]]
# Configure kernel parameters for maximum security (sysctl hardening). (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#sysctl config:|sysctl config]])
# Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event). (sample [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#auditd rules config:|auditd rules config]]
# Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.
# If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.
# Follow the principle of Attack Surface Reduction (or Occam's_razor) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
## If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
## If you are certain you will never use it, remove it completely from the system.
## This practice reduces potential attack vectors and strengthens overall system security.
## Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications. Always create a full system backup before making any significant configuration changes or modifications.
# Perform regular antivirus and anti-rootkit scans of the system. In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.
# Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:
<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

'''Related Aspects of Internet Security'''

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

1. Store passwords in a reliable password manager.

'''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:

* relying on human memory, with the risk of forgetting or confusing credentials;
* storing passwords on paper media, which can be damaged, lost, or stolen;
* saving passwords in web browsers in unencrypted form;
* keeping passwords in plain text files on the desktop or in other directories without encryption;
* and similar approaches.

Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.

A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.

* Regularly create up-to-date backups of the ''encrypted'' password database.

* Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.

Additional Practical Recommendations

A password manager (for example, KeePassXC) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.

In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.

It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).

2. Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [[wikipedia:Authenticator_app|Authenticator_app]]), or a hardware security key such as a [[wikipedia:YubiKey|YubiKey]].

This is a critical cybersecurity measure — neglecting it can completely undermine all your efforts in configuring a secure Linux system.

The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:

* YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
* It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
* Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number. For now, it is one of the most reliable hardware-based options for two-factor authentication.

3. Using VPN to improve privacy and security

''If you are a private user'', you can also configure a system-wide VPN (for example, ProtonVPN) so that all device traffic is routed through it — not only browser traffic or traffic from specific applications.

Enable the “killswitch” mode and disable it only when necessary, re-enabling it immediately afterwards.

It is also recommended to periodically change VPN servers, doing so at different and unpredictable intervals.

Using a VPN increases your privacy: all of your traffic will be encrypted from observers on your local network and from your internet service provider. This makes it more difficult for an attacker to apply certain social-engineering methods based on traffic analysis, and it also helps protect your privacy in the event that your provider’s infrastructure is compromised.

''If you own a server'' and want access to it to be available only to trusted private or legal entities, while also increasing its protection against unauthorized access, you can configure the server so that SSH and other internal services are accessible exclusively through OpenVPN using TLS authentication (tls-auth / tls-crypt) and unique client certificates instead of passwords.

4. Actively study and apply artificial intelligence to improve security configurations in Debian and other Linux distributions, as well as to address related cybersecurity tasks. A lack of knowledge often becomes the weakest link; AI can provide accurate, structured recommendations interactively and help automate repetitive or complex operations.

5. If privacy is a priority, consider reducing reliance on the Google ecosystem and switching to more privacy-focused alternatives (for example, proton.me and similar services). Google provides very strong security, but its services collect extensive telemetry for analysis. While this data is encrypted and not accessible to attackers, it may still be undesirable for users who value strict privacy.

''Always verify AI-generated recommendations before applying them in production environments. Test any changes in an isolated system, review generated commands or configurations, and ensure that suggestions align with your threat model and security architecture.''

''In practice, users who effectively leverage AI tools are significantly better prepared, and the adoption of such technologies makes malicious activity considerably more difficult for attackers.''

'''''Note:''' Artificial intelligence tools are mentioned here as optional technical aids, not as an endorsement of any specific service or vendor.''

6. It is also important to consider the possibility of hardware-level attacks.

Although such attacks are significantly less common and typically require more resources than software-based attacks, they remain a potential threat. In certain scenarios, an adversary may exploit vulnerabilities in device firmware or conduct a combined attack targeting both software and hardware layers. Examples include remote injection of malicious code into the firmware of a motherboard, router, optical modem, or other hardware components.

If, after a thorough software-level audit, a security issue remains unresolved, it is advisable <nowiki>'''</nowiki>to perform a hardware-level assessment<nowiki>'''</nowiki> as well, including verification of device firmware integrity and configuration.

<blockquote>'''And most importantly — give up the illusion of complete security. We live in conditions of a severe information war, and everyone must make efforts so that malicious actors cannot freely spy on desktops and servers.'''</blockquote>

'''Examples of Deep Custom Security Configurations'''

Below are examples of strong, individualized configurations for '''SELinux''', '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

====== SELinux config: ======
<syntaxhighlight lang="terminfo">
root@user:/home/user# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
root@user:/home/user# sestatus -v
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

Process contexts:
Current context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Init context: system_u:system_r:init_t:s0
/sbin/agetty system_u:system_r:getty_t:s0

File contexts:
Controlling terminal: unconfined_u:object_r:user_devpts_t:s0
/etc/passwd system_u:object_r:etc_t:s0
/etc/shadow system_u:object_r:unlabeled_t:s0
/bin/bash system_u:object_r:shell_exec_t:s0
/bin/login system_u:object_r:login_exec_t:s0
/bin/sh system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0
/sbin/agetty system_u:object_r:getty_exec_t:s0
/sbin/init system_u:object_r:bin_t:s0 -> system_u:object_r:init_exec_t:s0
/lib/ld-linux.so.2 system_u:object_r:lib_t:s0 -> system_u:object_r:ld_so_t:s0
</syntaxhighlight>

====== nftables config: ======
<syntaxhighlight lang="bash">
#!/usr/sbin/nft -f

flush ruleset

table inet filter {

# = Main chain policy =
chain input {
type filter hook input priority 0;
policy drop;

# = Common rule set =
# 🌀 Allow loopback interface (internal system processes)
iif "lo" accept

# == 🔁 Allow established and related connections ==
ct state established,related accept

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# == 🔒 Limit the rate of NEW connections per source IP (basic anti-DDoS protection) ==
# If you experience issues with slow or failed page loads in your browser,
# try increasing the limit, for example:
# ip saddr 0.0.0.0/0 ct state new limit rate 50/second burst 100 packets accept
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == 🚫 Blocking SSDP and mDNS (local broadcast discovery protocols) ==
ip daddr 239.255.255.250 udp dport 1900 drop # ❌ SSDP (UPnP/device discovery)
ip daddr 224.0.0.251 udp dport 5353 drop # ❌ mDNS (Bonjour, Avahi)

# == 🛑 Blocking NetBIOS and LLMNR (Windows/systemd internal LAN protocols) ==
udp dport 137 drop # ❌ NetBIOS Name Service (Windows network names)
udp dport 138 drop # ❌ NetBIOS Datagram Service (LAN name discovery)
udp dport 5355 drop # ❌ LLMNR (Link-Local Multicast Name Resolution)

# = Set of blocked IP addresses and ranges =

# == 🧱 Blocking known botnets and proxy networks ==
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} log prefix "🔥 BAN: known bots " flags all
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} drop

# == 🚫 Blocking strange TCP flags (XMAS, NULL scans and others) ==
tcp flags & (fin|syn|rst|psh|ack|urg) == 0 drop # NULL scan
tcp flags & (fin|psh|urg) == (fin|psh|urg) drop # XMAS scan
tcp flags & (fin|syn) == (fin|syn) drop # SYN-ACK scan
tcp flags & (syn|rst|fin) == (syn|rst|fin) drop # Xmas scan
tcp flags & (syn|fin|rst|psh|ack) == (syn|rst|fin|ack) drop # Xmas scan

# == 🚫 Blocking fragmented packets — commonly used in filter evasion ==
ip frag-off & 0x1fff != 0 drop

# == 🔒 Blocking spoofed IP packets ==
ip saddr 127.0.0.0/8 drop # localhost
ip saddr 10.0.0.0/8 drop # private network
ip saddr 172.16.0.0/12 drop # private network
ip saddr 192.168.0.0/16 drop # private network
ip saddr 169.254.0.0/16 drop # APIPA
ip saddr 0.0.0.0/8 drop # invalid address
ip saddr 224.0.0.0/4 drop # multicast
ip saddr 240.0.0.0/5 drop # reserved
}

# = Main chain policy =
chain forward {
type filter hook forward priority 0;
policy accept;

# = Blocking various types of attacks =
# Required in chain forward only if Docker or Oracle VirtualBox is present.
# If needed — uncomment.

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
# ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
# ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
# ip protocol icmp icmp type echo-request limit rate 1/second accept
# ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
# ip protocol icmp icmp type echo-request drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports required for application operation ==
tcp dport {
53, # DNS — needed for domain name resolution
80, # HTTP — web traffic, updates and resource loading
443, # HTTPS — secure web traffic, VPN, browser
12043, # Custom 3D Application — specific client port
13000-13050 # Custom 3D Application — dynamic client port range
} accept

# == Allow UDP ports required for application operation ==
udp dport {
53, # DNS — needed for domain name resolution
443, # HTTPS via QUIC/HTTP3, browser protocols
3478, # STUN/TURN — WebRTC and video calls
3479-3481 # STUN/TURN — WebRTC and video calls
} accept

# = Blocking dangerous and unnecessary TCP/UDP ports and ranges =

# These blocklists are intended for a DESKTOP / workstation.
# They block remote access, outdated services, proxies, DBs, IoT, and ports
# often used by malware, scanners, and C2 infrastructures.
#
# ⚠ If you use the system as a SERVER, enable IP forwarding,
# or run services with internal routing
# (Docker NAT/bridge, VirtualBox host-only/bridged, VPN clients),
# carefully review the blocked ports/ranges in the forward chain —
# these services may need extra ports.
# Adjust or comment out required items if necessary.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high risk) ===
22, # SSH — common brute-force target
23, # Telnet — outdated, no encryption
3389, # RDP — Windows remote desktop
5900, # VNC — remote access, frequent vulnerabilities
# === FTP / SMB / NetBIOS (unsafe file-sharing protocols) ===
21, # FTP — insecure protocol
137, # NetBIOS Name Service
138, # NetBIOS Datagram
139, # NetBIOS Session
445, # SMB/CIFS — common exploit target
# === Databases (NEVER expose to the Internet) ===
3306, # MySQL/MariaDB
1433, # MS SQL Server
1434, # MS SQL Browser
# === HTTP-alt/Proxy/Elasticsearch (exploited frequently) ===
8080, # HTTP proxy / web interfaces — often exposed accidentally
9200, # Elasticsearch API — full remote data access
# === UPnP/IoT (insecure by design) ===
1900, # SSDP / UPnP
# === Common for malware (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell
5555, # Android ADB / IoT botnets
9001, # Tor transport (used by malware)
1234, # Netcat / reverse connections
1337, # Common C2 port used by malware
# === ⚠️ Scanner ports and potentially vulnerable services ===
1080, # SOCKS proxy — used to bypass filtering
3128, # Squid proxy — may be abused as open proxy
8000, # Alternative HTTP ports, dev servers
8888, # Web interfaces, proxies, dev tools
10000 # Webmin — remote admin panel, frequent attacks
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; abused by attackers
162 # SNMP Trap — also potentially vulnerable
} drop

# Attention! Blocking wide port ranges — be careful!
# Do not break system or application functionality!

# == TCP port ranges not used by a workstation during transit routing ==
# Blocked to prevent unwanted forwarding, hidden tunnels,
# NAT evasion, parasitic flows, and potential forward-path attacks.

tcp dport {
1024-2047, # System/legacy services; rarely needed in forward
2048-4095, # Proprietary daemons; NFS (2049) — check if used
4096-8191, # Old VPNs, some games, P2P; rarely needed on desktop
8192-12287, # Alternative HTTP/proxy, multimedia; test as needed
12288-16383, # Media/VoIP (TCP fallback); may break calls
16384-24575, # RTP/WebRTC (TCP fallback); block unless AV needed
24576-32767, # Dynamic ranges for games/VPN; may cause issues
32768-49151, # Registered/ephemeral; risky — may break NAT, Docker, VM
49152-65535 # High ephemeral; widely used by modern apps
} drop

# == 🚫 Blocking UDP ports — high and dynamic ranges ==
udp dport {
1024-9999, # low/mid ephemeral ports; used by trojans, P2P, games, VPN
10000-65535 # high ephemeral; used by dynamic apps, VPN, Docker
} drop

# = 🕷️ Suspicious IPs — large ranges often used by botnets, spam nets, and scanners =
ip saddr {
185.0.0.0/8, # abused hosting and proxy networks
37.0.0.0/8, # cheap VPS, frequent scanning sources
88.0.0.0/8, # common brute-force and scanner range
77.0.0.0/8, # TOR/proxy nodes
91.0.0.0/8 # botnets and “grey-zone” hosting
} drop
}

chain output {
# = Main chain policy =
type filter hook output priority 0;
policy accept;

# = Blocking various types of attacks =

# == 🔒 Limiting new connections from a single IP (anti-DDoS) ==
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# = ICMP protocol restrictions =

# == 🛡️ Ping limitation ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == Critically important ICMP for network ==
ip protocol icmp icmp type { destination-unreachable, time-exceeded, parameter-problem } accept

# == Important ICMPv6 for IPv6 ==
ip6 nexthdr icmpv6 icmpv6 type { 1, 2, 3, 4 } accept
ip6 nexthdr icmpv6 icmpv6 type { 135, 136 } accept # NS/NA
ip6 nexthdr icmpv6 icmpv6 type { 133, 134 } accept # RS/RA

# == Drop all other ICMP and ICMPv6 ==
ip protocol icmp drop # drop all other ICMP
ip6 nexthdr icmpv6 drop # drop all other ICMPv6

# = SCTP protocol blocking =
# 99.9% of desktop systems do not use SCTP at all
meta l4proto sctp drop

# = DCCP — Datagram Congestion Control Protocol blocking =
# Not used by any mainstream desktop applications
meta l4proto dccp drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports and ranges required for application functionality ==
tcp dport {
53, # DNS client. Required for Internet to work: domain name resolution (UDP/TCP).
80, # HTTP traffic to unencrypted websites; apps may use it for API/redirects.
443, # HTTPS. Main port for all encrypted web traffic — browsers, API, VPN, updates.
3306, # MySQL client. Needed if you connect to MySQL.
3478, # STUN/TURN WebRTC. Needed for audio/video/Discord.
3000, # Node.js dev servers. Needed for development.
3690, # SVN. If you work with an old repository.
4443, # Alternative HTTPS (some APIs). Also used by some VPN/clients.
12043, # Required for Custom 3D Application.
13000-13050 # Required for Custom 3D Application.
} accept

# == Allow UDP ports and ranges required for applications ==
udp dport {
443, # Required for fast and stable operation of modern websites
# (Google, YouTube, ChatGPT, Cloudflare)
13000-13050 # Required for Custom 3D Application.
} accept

# = Blocking potentially dangerous / unnecessary TCP/UDP ports =

# These blocks are intended for a DESKTOP / workstation.
# ⚠ If you use the system as a SERVER —
# adjust or comment out the required ports/ranges as needed.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high-risk) ===
22, # SSH — target of brute-force attacks.
23, # Telnet — outdated, unencrypted.
3389, # RDP — Windows remote access.
5900, # VNC — remote access, often vulnerable.
# === FTP / SMB / NetBIOS (dangerous file-sharing services) ===
21, # FTP — insecure protocol.
137, # NetBIOS Name Service.
138, # NetBIOS Datagram.
139, # NetBIOS Session.
445, # SMB/CIFS — frequent exploitation target.
# === Databases (NEVER open to the Internet) ===
3306, # MySQL/MariaDB.
1433, # MS SQL Server.
1434, # MS SQL Browser.
# === HTTP-alt/Proxy/Elasticsearch (dangerous, often attacked) ===
8080, # HTTP proxy / web interfaces — often exposed test interfaces.
9200, # Elasticsearch API — full remote access to data.
# === UPnP/IoT (vulnerable by design) ===
1900, # SSDP / UPnP.
# === Common malware ports (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell.
5555, # Android ADB / IoT botnets.
9001, # Tor transport (used by malware).
1234, # Netcat / reverse connections.
1337, # Common C2 malware port.
# === ⚠️ Ports of scanners and potentially vulnerable services ===
1080, # SOCKS proxy — often abused for bypassing filters.
3128, # Squid HTTP proxy — can be used as open proxy.
8000, # Alternative HTTP ports, web services — potentially vulnerable.
8888, # Alternative web interfaces — test and proxy ports.
10000 # Webmin — web admin panel, target of attacks.
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; can be abused by attackers.
162 # SNMP Trap — same, potential vulnerability.
} drop

# Warning! ⚠️ Be careful blocking wide port ranges! ⚠️
# Do not break system or application functionality!
# If you need a range — uncomment.
# If you don’t — comment out.

# == Blocking “dangerous” and desktop-unnecessary TCP port ranges ==
tcp dport {
1-1023, # 🛑 Privileged ports.
1024-2047, # r-commands (rlogin, rsh, rexec), old RPC, NFS, legacy daemons.
2048-3071, # Rare proprietary protocols and middleware.
3072-4999, # Mostly ports of legacy, server, corporate apps;
# rarely needed on workstations.
5000-5999, # Alternative services, old P2P/admin ports, rarely used on desktops.
7000-7999, # Alternative/test ports, often used by trojans.
9000-9999, # Web services, proxies, possible backdoor ports.
10000-19998, # Dynamic/high service ports; may be required by some apps like Custom 3D Application,
# but not needed by most desktop services.
19999-32767 # Old ephemeral port range; used by P2P, games, some VPNs,
# but system services rarely use them.
} drop

# == Blocking “dangerous” and desktop-unnecessary UDP port ranges ==
udp dport {
1024-2047, # Old UNIX services, RPC, NFS, r-commands, legacy daemons.
# Usually safe to block.
2048-4095, # Rarely used standard ports, proprietary services.
# Usually safe to block.
4096-8191, # VPN, games, P2P, WebRTC, VoIP of some clients.
# Can block, but cautiously: may affect VPN/apps.
8192-12287, # QUIC/HTTP3, proxies, multimedia protocols.
# Might cause side effects; better test first.
12288-16383, # Old RTP/VoIP ranges and media streams.
# Can block, but might break video calls.
16384-24575, # Main RTP range (audio/video), WebRTC, VoIP.
# ❗ Do not block if you need video calls/WebRTC/VPN.
24576-32767 # Dynamic ports for VPN, P2P, games, streaming data.
# ❗ May break VPN or some apps.
} drop

# == 🕷️ Blocking suspicious IPs —
# large ranges often used by botnets, spam networks, and scanners ==
ip saddr {
185.0.0.0/8, # Abused hosting and proxy networks.
37.0.0.0/8, # Cheap VPS, scanning sources.
88.0.0.0/8, # Frequent brute-force and scanners.
77.0.0.0/8, # Massive TOR/proxy nodes.
91.0.0.0/8 # Botnets and “grey” hosting.
} drop
}
}

</syntaxhighlight>

====== sysctl config: ======
kernel parameters configuration

/etc/sysctl.d/99-protect.conf<syntaxhighlight lang="bash">
# 1 Ignore ICMP on interfaces
net.ipv4.icmp_echo_ignore_all = 1

# 2 Do not respond to ICMP broadcast (against Smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 3 Enable SYN backlog reduction
net.ipv4.tcp_syncookies = 1

# 4 Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 5 Log packets with incorrect routing
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# 6 Disable ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# 7 Disable packet forwarding
net.ipv4.ip_forward = 0

# 8 Disable IPv6 support
net.ipv4.conf.all.disable_ipv6 = 1
net.ipv4.conf.default.disable_ipv6 = 1

# 9 Prevent sending TCP segments with null windows
net.ipv4.tcp_rfc1337 = 1

# 10 Disable ARP filtering for automatic routing
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1

# 11 Limit the maximum size of the incoming TCP window
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# 12 Drop packets with incorrect checksums
net.ipv4.conf.all.drop_unicast_in_l2_multicast = 1
net.ipv4.conf.default.drop_unicast_in_l2_multicast = 1

# 13 Disable IPv6 forwarding
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# 14 Limit the maximum number of SYN packet retries
net.ipv4.tcp_synack_retries = 2

# 15 Increase routing cache lifetime
net.ipv4.route.max_size = 32768
</syntaxhighlight>

====== auditd rules config: ======
/etc/audit/rules.d/audit.rules

<syntaxhighlight lang="bash">
## Flush rules
-D

## Buffers
-b 8192
--backlog_wait_time 60000
-f 1

## Network audit
-a always,exit -F arch=b64 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b64 -S accept4 -F success=1 -k network_accept
-a always,exit -F arch=b32 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b32 -S accept4 -F success=1 -k network_accept

## Logging execve commands
-a always,exit -F arch=b64 -S execve -F key=exec_log

## Audit logins and sessions
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session

## sudo / su
-w /etc/sudoers -p wa -k sudo
-w /etc/sudoers.d/ -p wa -k sudo
-w /bin/su -p x -k su_cmd

## Account and configuration changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/hosts -p wa -k system_conf
-w /etc/hostname -p wa -k system_conf
-w /etc/resolv.conf -p wa -k system_conf
-w /etc/issue -p wa -k system_conf
-w /etc/network/ -p wa -k system_conf

## Time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -F key=time_change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -F key=time_change

## Audit SSH connections and changes
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /var/log/auth.log -p wa -k ssh_login

## Audit usage of remote tools (e.g., SSH, netcat)
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/nc -k nc_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/nc -k nc_process

## Audit privileged access
-a always,exit -F arch=b64 -S setuid -S setgid -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -S setgid -k privilege_escalation
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/sudoers.d/ -p wa -k sudoers_changes
-w /bin/sudo -p x -k sudo_command

## Monitor credential changes
#-w /root/.ssh/ -p wa -k ssh_keys
#-w /home/*/.ssh/ -p wa -k ssh_keys

## Audit use of remote network services
-a always,exit -F arch=b64 -S socket -F success=1 -k socket_connect
-a always,exit -F arch=b32 -S socket -F success=1 -k socket_connect

# Log package installation and removal via dpkg
-w /usr/bin/dpkg -p x
-w /usr/sbin/apt-get -p x
-w /usr/bin/apt -p x
</syntaxhighlight>

==== UsefulPrograms ====

Here is the list of programs useful for configuring and maintaining the security of Linux systems. The included programs are either open-source (the majority) or commercial, but with freely available limited features sufficient to address core security tasks (a smaller portion).

https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/UsefulPrograms

==== External Resources ====

[https://www.debian.org/doc/manuals/securing-debian-manual/index.en.html|Securing Debian Manual 3.19 — Javier Fernández-Sanguino Peña.]
This document describes security in the Debian project and in the Debian operating system. Starting with the process of securing and hardening the default Debian GNU/Linux distribution installation, it also covers some of the common tasks to set up a secure network environment using Debian GNU/Linux, gives additional information on the security tools available and talks about how security is enforced in Debian by the security and audit team.

[https://medium.com/%40ihouelecaurcy/the-complete-nftables-guide-modern-linux-firewall-mastery-79fb86894d5c|The Complete nftables Guide: Modern Linux Firewall Mastery — Ihouele Caurcy]
The definitive guide to nftables — the modern replacement for iptables, ip6tables, arptables, and ebtables. From basic concepts to enterprise-level configurations.

[https://notes.suhaib.in/docs/tech/utilities/iptables-nftables-and-you-a-friendly-guide-to-traffic-rules/|iptables, nftables, and You A Friendly Guide to Traffic Rules]
A friendly guide to iptables and nftables in Linux: explains Netfilter architecture, tables, chains and rules, with configuration examples (SSH, IP blocking, port forwarding). Covers differences between iptables and nftables, migration, and compatibility with modern firewall tools. Useful for understanding the iptables→nftables transition and practical examples.

[https://public.jdstone1.com/books_and_magazines/Computer_Books/Operating_Systems/SELinux%20System%20Administration%20(3rd%20ed).pdf|SELinux System Administration Third Edition — Sven Vermeulen.]
Implement mandatory access control to secure applications, users, and information flows on Linux.

https://gitlab.com/apparmor/apparmor/-/wikis/home
The official wiki for the AppArmor security project on Linux. Provides guidance for users and developers, instructions for creating and managing security profiles, example access policies for applications, and best practices to protect the operating system.

[https://nallino.net/stockage/security/Linux_Mint_Security.pdf|Security, Privacy and Anonymity in Linux Mint — Michel Nallino.]
A good and comprehensive work on Linux Mint security that can also be useful for other Linux distributions.

[https://www.cisa.gov/topics/cybersecurity-best-practices|CISA — Cybersecurity Best Practices]
CISA (Certified Information Systems Auditor) provides information on cybersecurity best practices to help individuals and organizations implement preventative measures and manage cyber risks.

This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131,
it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks

[[index.php?title=Category:Security]]
[[index.php?title=Category:Hardening]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2025-12-16T17:28:21Z

Blackcat568: /* UsefulPrograms */

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.

* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

===== Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build). =====
Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

# 1. Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.
# If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to type long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>
# Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.
# Avoid using the superuser account or sudo without a clear necessity — and never execute arbitrary scripts with sudo. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
## Always read a script fully before running it (less script.sh, cat script.sh).
## Never paste commands from untrusted or unverified sources into the terminal.
## Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
## Follow the principle of least privilege — create separate user accounts and limit access rights where possible Important: Improper or careless use of sudo and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.
# Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. You may also consider switching to SELinux. If you have difficulty configuring AppArmor or SELinux, seek help from specialists or use AI-based tools. My SELinux configuration is attached below (I use SELinux on Debian 12 — it works reliably).
# Use advanced network filtering settings: iptables or nftables, or a commercial firewall. (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#nftables config:|nftables config]]
# Configure kernel parameters for maximum security (sysctl hardening). (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#sysctl config:|sysctl config]])
# Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event). (sample [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#auditd rules config:|auditd rules config]]
# Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.
# If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.
# Follow the principle of Attack Surface Reduction (or Occam's_razor) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
## If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
## If you are certain you will never use it, remove it completely from the system.
## This practice reduces potential attack vectors and strengthens overall system security.
## Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications. Always create a full system backup before making any significant configuration changes or modifications.
# Perform regular antivirus and anti-rootkit scans of the system. In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.
# Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:
<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

'''Related Aspects of Internet Security'''

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

1. Store passwords in a reliable password manager.

'''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:

* relying on human memory, with the risk of forgetting or confusing credentials;
* storing passwords on paper media, which can be damaged, lost, or stolen;
* saving passwords in web browsers in unencrypted form;
* keeping passwords in plain text files on the desktop or in other directories without encryption;
* and similar approaches.

Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.

A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.

* Regularly create up-to-date backups of the ''encrypted'' password database.

* Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.

Additional Practical Recommendations

A password manager (for example, KeePassXC) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.

In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.

It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).

2. Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [[wikipedia:Authenticator_app|Authenticator_app]]), or a hardware security key such as a [[wikipedia:YubiKey|YubiKey]].

This is a critical cybersecurity measure — neglecting it can completely undermine all your efforts in configuring a secure Linux system.

The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:

* YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
* It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
* Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number. For now, it is one of the most reliable hardware-based options for two-factor authentication.

3. Using VPN to improve privacy and security

''If you are a private user'', you can also configure a system-wide VPN (for example, ProtonVPN) so that all device traffic is routed through it — not only browser traffic or traffic from specific applications.

Enable the “killswitch” mode and disable it only when necessary, re-enabling it immediately afterwards.

It is also recommended to periodically change VPN servers, doing so at different and unpredictable intervals.

Using a VPN increases your privacy: all of your traffic will be encrypted from observers on your local network and from your internet service provider. This makes it more difficult for an attacker to apply certain social-engineering methods based on traffic analysis, and it also helps protect your privacy in the event that your provider’s infrastructure is compromised.

''If you own a server'' and want access to it to be available only to trusted private or legal entities, while also increasing its protection against unauthorized access, you can configure the server so that SSH and other internal services are accessible exclusively through OpenVPN using TLS authentication (tls-auth / tls-crypt) and unique client certificates instead of passwords.

4. Actively study and apply artificial intelligence to improve security configurations in Debian and other Linux distributions, as well as to address related cybersecurity tasks. A lack of knowledge often becomes the weakest link; AI can provide accurate, structured recommendations interactively and help automate repetitive or complex operations.

5. If privacy is a priority, consider reducing reliance on the Google ecosystem and switching to more privacy-focused alternatives (for example, proton.me and similar services). Google provides very strong security, but its services collect extensive telemetry for analysis. While this data is encrypted and not accessible to attackers, it may still be undesirable for users who value strict privacy.

''Always verify AI-generated recommendations before applying them in production environments. Test any changes in an isolated system, review generated commands or configurations, and ensure that suggestions align with your threat model and security architecture.''

''In practice, users who effectively leverage AI tools are significantly better prepared, and the adoption of such technologies makes malicious activity considerably more difficult for attackers.''

'''''Note:''' Artificial intelligence tools are mentioned here as optional technical aids, not as an endorsement of any specific service or vendor.''

6. It is also important to consider the possibility of hardware-level attacks.

Although such attacks are significantly less common and typically require more resources than software-based attacks, they remain a potential threat. In certain scenarios, an adversary may exploit vulnerabilities in device firmware or conduct a combined attack targeting both software and hardware layers. Examples include remote injection of malicious code into the firmware of a motherboard, router, optical modem, or other hardware components.

If, after a thorough software-level audit, a security issue remains unresolved, it is advisable <nowiki>'''</nowiki>to perform a hardware-level assessment<nowiki>'''</nowiki> as well, including verification of device firmware integrity and configuration.

<blockquote>'''And most importantly — give up the illusion of complete security. We live in conditions of a severe information war, and everyone must make efforts so that malicious actors cannot freely spy on desktops and servers.'''</blockquote>

'''Examples of Deep Custom Security Configurations'''

Below are examples of strong, individualized configurations for '''SELinux''', '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

====== SELinux config: ======
<syntaxhighlight lang="terminfo">
root@user:/home/user# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
root@user:/home/user# sestatus -v
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

Process contexts:
Current context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Init context: system_u:system_r:init_t:s0
/sbin/agetty system_u:system_r:getty_t:s0

File contexts:
Controlling terminal: unconfined_u:object_r:user_devpts_t:s0
/etc/passwd system_u:object_r:etc_t:s0
/etc/shadow system_u:object_r:unlabeled_t:s0
/bin/bash system_u:object_r:shell_exec_t:s0
/bin/login system_u:object_r:login_exec_t:s0
/bin/sh system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0
/sbin/agetty system_u:object_r:getty_exec_t:s0
/sbin/init system_u:object_r:bin_t:s0 -> system_u:object_r:init_exec_t:s0
/lib/ld-linux.so.2 system_u:object_r:lib_t:s0 -> system_u:object_r:ld_so_t:s0
</syntaxhighlight>

====== nftables config: ======
<syntaxhighlight lang="bash">
#!/usr/sbin/nft -f

flush ruleset

table inet filter {

# = Main chain policy =
chain input {
type filter hook input priority 0;
policy drop;

# = Common rule set =
# 🌀 Allow loopback interface (internal system processes)
iif "lo" accept

# == 🔁 Allow established and related connections ==
ct state established,related accept

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# == 🔒 Limit the rate of NEW connections per source IP (basic anti-DDoS protection) ==
# If you experience issues with slow or failed page loads in your browser,
# try increasing the limit, for example:
# ip saddr 0.0.0.0/0 ct state new limit rate 50/second burst 100 packets accept
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == 🚫 Blocking SSDP and mDNS (local broadcast discovery protocols) ==
ip daddr 239.255.255.250 udp dport 1900 drop # ❌ SSDP (UPnP/device discovery)
ip daddr 224.0.0.251 udp dport 5353 drop # ❌ mDNS (Bonjour, Avahi)

# == 🛑 Blocking NetBIOS and LLMNR (Windows/systemd internal LAN protocols) ==
udp dport 137 drop # ❌ NetBIOS Name Service (Windows network names)
udp dport 138 drop # ❌ NetBIOS Datagram Service (LAN name discovery)
udp dport 5355 drop # ❌ LLMNR (Link-Local Multicast Name Resolution)

# = Set of blocked IP addresses and ranges =

# == 🧱 Blocking known botnets and proxy networks ==
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} log prefix "🔥 BAN: known bots " flags all
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} drop

# == 🚫 Blocking strange TCP flags (XMAS, NULL scans and others) ==
tcp flags & (fin|syn|rst|psh|ack|urg) == 0 drop # NULL scan
tcp flags & (fin|psh|urg) == (fin|psh|urg) drop # XMAS scan
tcp flags & (fin|syn) == (fin|syn) drop # SYN-ACK scan
tcp flags & (syn|rst|fin) == (syn|rst|fin) drop # Xmas scan
tcp flags & (syn|fin|rst|psh|ack) == (syn|rst|fin|ack) drop # Xmas scan

# == 🚫 Blocking fragmented packets — commonly used in filter evasion ==
ip frag-off & 0x1fff != 0 drop

# == 🔒 Blocking spoofed IP packets ==
ip saddr 127.0.0.0/8 drop # localhost
ip saddr 10.0.0.0/8 drop # private network
ip saddr 172.16.0.0/12 drop # private network
ip saddr 192.168.0.0/16 drop # private network
ip saddr 169.254.0.0/16 drop # APIPA
ip saddr 0.0.0.0/8 drop # invalid address
ip saddr 224.0.0.0/4 drop # multicast
ip saddr 240.0.0.0/5 drop # reserved
}

# = Main chain policy =
chain forward {
type filter hook forward priority 0;
policy accept;

# = Blocking various types of attacks =
# Required in chain forward only if Docker or Oracle VirtualBox is present.
# If needed — uncomment.

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
# ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
# ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
# ip protocol icmp icmp type echo-request limit rate 1/second accept
# ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
# ip protocol icmp icmp type echo-request drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports required for application operation ==
tcp dport {
53, # DNS — needed for domain name resolution
80, # HTTP — web traffic, updates and resource loading
443, # HTTPS — secure web traffic, VPN, browser
12043, # Custom 3D Application — specific client port
13000-13050 # Custom 3D Application — dynamic client port range
} accept

# == Allow UDP ports required for application operation ==
udp dport {
53, # DNS — needed for domain name resolution
443, # HTTPS via QUIC/HTTP3, browser protocols
3478, # STUN/TURN — WebRTC and video calls
3479-3481 # STUN/TURN — WebRTC and video calls
} accept

# = Blocking dangerous and unnecessary TCP/UDP ports and ranges =

# These blocklists are intended for a DESKTOP / workstation.
# They block remote access, outdated services, proxies, DBs, IoT, and ports
# often used by malware, scanners, and C2 infrastructures.
#
# ⚠ If you use the system as a SERVER, enable IP forwarding,
# or run services with internal routing
# (Docker NAT/bridge, VirtualBox host-only/bridged, VPN clients),
# carefully review the blocked ports/ranges in the forward chain —
# these services may need extra ports.
# Adjust or comment out required items if necessary.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high risk) ===
22, # SSH — common brute-force target
23, # Telnet — outdated, no encryption
3389, # RDP — Windows remote desktop
5900, # VNC — remote access, frequent vulnerabilities
# === FTP / SMB / NetBIOS (unsafe file-sharing protocols) ===
21, # FTP — insecure protocol
137, # NetBIOS Name Service
138, # NetBIOS Datagram
139, # NetBIOS Session
445, # SMB/CIFS — common exploit target
# === Databases (NEVER expose to the Internet) ===
3306, # MySQL/MariaDB
1433, # MS SQL Server
1434, # MS SQL Browser
# === HTTP-alt/Proxy/Elasticsearch (exploited frequently) ===
8080, # HTTP proxy / web interfaces — often exposed accidentally
9200, # Elasticsearch API — full remote data access
# === UPnP/IoT (insecure by design) ===
1900, # SSDP / UPnP
# === Common for malware (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell
5555, # Android ADB / IoT botnets
9001, # Tor transport (used by malware)
1234, # Netcat / reverse connections
1337, # Common C2 port used by malware
# === ⚠️ Scanner ports and potentially vulnerable services ===
1080, # SOCKS proxy — used to bypass filtering
3128, # Squid proxy — may be abused as open proxy
8000, # Alternative HTTP ports, dev servers
8888, # Web interfaces, proxies, dev tools
10000 # Webmin — remote admin panel, frequent attacks
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; abused by attackers
162 # SNMP Trap — also potentially vulnerable
} drop

# Attention! Blocking wide port ranges — be careful!
# Do not break system or application functionality!

# == TCP port ranges not used by a workstation during transit routing ==
# Blocked to prevent unwanted forwarding, hidden tunnels,
# NAT evasion, parasitic flows, and potential forward-path attacks.

tcp dport {
1024-2047, # System/legacy services; rarely needed in forward
2048-4095, # Proprietary daemons; NFS (2049) — check if used
4096-8191, # Old VPNs, some games, P2P; rarely needed on desktop
8192-12287, # Alternative HTTP/proxy, multimedia; test as needed
12288-16383, # Media/VoIP (TCP fallback); may break calls
16384-24575, # RTP/WebRTC (TCP fallback); block unless AV needed
24576-32767, # Dynamic ranges for games/VPN; may cause issues
32768-49151, # Registered/ephemeral; risky — may break NAT, Docker, VM
49152-65535 # High ephemeral; widely used by modern apps
} drop

# == 🚫 Blocking UDP ports — high and dynamic ranges ==
udp dport {
1024-9999, # low/mid ephemeral ports; used by trojans, P2P, games, VPN
10000-65535 # high ephemeral; used by dynamic apps, VPN, Docker
} drop

# = 🕷️ Suspicious IPs — large ranges often used by botnets, spam nets, and scanners =
ip saddr {
185.0.0.0/8, # abused hosting and proxy networks
37.0.0.0/8, # cheap VPS, frequent scanning sources
88.0.0.0/8, # common brute-force and scanner range
77.0.0.0/8, # TOR/proxy nodes
91.0.0.0/8 # botnets and “grey-zone” hosting
} drop
}

chain output {
# = Main chain policy =
type filter hook output priority 0;
policy accept;

# = Blocking various types of attacks =

# == 🔒 Limiting new connections from a single IP (anti-DDoS) ==
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# = ICMP protocol restrictions =

# == 🛡️ Ping limitation ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == Critically important ICMP for network ==
ip protocol icmp icmp type { destination-unreachable, time-exceeded, parameter-problem } accept

# == Important ICMPv6 for IPv6 ==
ip6 nexthdr icmpv6 icmpv6 type { 1, 2, 3, 4 } accept
ip6 nexthdr icmpv6 icmpv6 type { 135, 136 } accept # NS/NA
ip6 nexthdr icmpv6 icmpv6 type { 133, 134 } accept # RS/RA

# == Drop all other ICMP and ICMPv6 ==
ip protocol icmp drop # drop all other ICMP
ip6 nexthdr icmpv6 drop # drop all other ICMPv6

# = SCTP protocol blocking =
# 99.9% of desktop systems do not use SCTP at all
meta l4proto sctp drop

# = DCCP — Datagram Congestion Control Protocol blocking =
# Not used by any mainstream desktop applications
meta l4proto dccp drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports and ranges required for application functionality ==
tcp dport {
53, # DNS client. Required for Internet to work: domain name resolution (UDP/TCP).
80, # HTTP traffic to unencrypted websites; apps may use it for API/redirects.
443, # HTTPS. Main port for all encrypted web traffic — browsers, API, VPN, updates.
3306, # MySQL client. Needed if you connect to MySQL.
3478, # STUN/TURN WebRTC. Needed for audio/video/Discord.
3000, # Node.js dev servers. Needed for development.
3690, # SVN. If you work with an old repository.
4443, # Alternative HTTPS (some APIs). Also used by some VPN/clients.
12043, # Required for Custom 3D Application.
13000-13050 # Required for Custom 3D Application.
} accept

# == Allow UDP ports and ranges required for applications ==
udp dport {
443, # Required for fast and stable operation of modern websites
# (Google, YouTube, ChatGPT, Cloudflare)
13000-13050 # Required for Custom 3D Application.
} accept

# = Blocking potentially dangerous / unnecessary TCP/UDP ports =

# These blocks are intended for a DESKTOP / workstation.
# ⚠ If you use the system as a SERVER —
# adjust or comment out the required ports/ranges as needed.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high-risk) ===
22, # SSH — target of brute-force attacks.
23, # Telnet — outdated, unencrypted.
3389, # RDP — Windows remote access.
5900, # VNC — remote access, often vulnerable.
# === FTP / SMB / NetBIOS (dangerous file-sharing services) ===
21, # FTP — insecure protocol.
137, # NetBIOS Name Service.
138, # NetBIOS Datagram.
139, # NetBIOS Session.
445, # SMB/CIFS — frequent exploitation target.
# === Databases (NEVER open to the Internet) ===
3306, # MySQL/MariaDB.
1433, # MS SQL Server.
1434, # MS SQL Browser.
# === HTTP-alt/Proxy/Elasticsearch (dangerous, often attacked) ===
8080, # HTTP proxy / web interfaces — often exposed test interfaces.
9200, # Elasticsearch API — full remote access to data.
# === UPnP/IoT (vulnerable by design) ===
1900, # SSDP / UPnP.
# === Common malware ports (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell.
5555, # Android ADB / IoT botnets.
9001, # Tor transport (used by malware).
1234, # Netcat / reverse connections.
1337, # Common C2 malware port.
# === ⚠️ Ports of scanners and potentially vulnerable services ===
1080, # SOCKS proxy — often abused for bypassing filters.
3128, # Squid HTTP proxy — can be used as open proxy.
8000, # Alternative HTTP ports, web services — potentially vulnerable.
8888, # Alternative web interfaces — test and proxy ports.
10000 # Webmin — web admin panel, target of attacks.
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; can be abused by attackers.
162 # SNMP Trap — same, potential vulnerability.
} drop

# Warning! ⚠️ Be careful blocking wide port ranges! ⚠️
# Do not break system or application functionality!
# If you need a range — uncomment.
# If you don’t — comment out.

# == Blocking “dangerous” and desktop-unnecessary TCP port ranges ==
tcp dport {
1-1023, # 🛑 Privileged ports.
1024-2047, # r-commands (rlogin, rsh, rexec), old RPC, NFS, legacy daemons.
2048-3071, # Rare proprietary protocols and middleware.
3072-4999, # Mostly ports of legacy, server, corporate apps;
# rarely needed on workstations.
5000-5999, # Alternative services, old P2P/admin ports, rarely used on desktops.
7000-7999, # Alternative/test ports, often used by trojans.
9000-9999, # Web services, proxies, possible backdoor ports.
10000-19998, # Dynamic/high service ports; may be required by some apps like Custom 3D Application,
# but not needed by most desktop services.
19999-32767 # Old ephemeral port range; used by P2P, games, some VPNs,
# but system services rarely use them.
} drop

# == Blocking “dangerous” and desktop-unnecessary UDP port ranges ==
udp dport {
1024-2047, # Old UNIX services, RPC, NFS, r-commands, legacy daemons.
# Usually safe to block.
2048-4095, # Rarely used standard ports, proprietary services.
# Usually safe to block.
4096-8191, # VPN, games, P2P, WebRTC, VoIP of some clients.
# Can block, but cautiously: may affect VPN/apps.
8192-12287, # QUIC/HTTP3, proxies, multimedia protocols.
# Might cause side effects; better test first.
12288-16383, # Old RTP/VoIP ranges and media streams.
# Can block, but might break video calls.
16384-24575, # Main RTP range (audio/video), WebRTC, VoIP.
# ❗ Do not block if you need video calls/WebRTC/VPN.
24576-32767 # Dynamic ports for VPN, P2P, games, streaming data.
# ❗ May break VPN or some apps.
} drop

# == 🕷️ Blocking suspicious IPs —
# large ranges often used by botnets, spam networks, and scanners ==
ip saddr {
185.0.0.0/8, # Abused hosting and proxy networks.
37.0.0.0/8, # Cheap VPS, scanning sources.
88.0.0.0/8, # Frequent brute-force and scanners.
77.0.0.0/8, # Massive TOR/proxy nodes.
91.0.0.0/8 # Botnets and “grey” hosting.
} drop
}
}

</syntaxhighlight>

====== sysctl config: ======
kernel parameters configuration

/etc/sysctl.d/99-protect.conf<syntaxhighlight lang="bash">
# 1 Ignore ICMP on interfaces
net.ipv4.icmp_echo_ignore_all = 1

# 2 Do not respond to ICMP broadcast (against Smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 3 Enable SYN backlog reduction
net.ipv4.tcp_syncookies = 1

# 4 Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 5 Log packets with incorrect routing
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# 6 Disable ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# 7 Disable packet forwarding
net.ipv4.ip_forward = 0

# 8 Disable IPv6 support
net.ipv4.conf.all.disable_ipv6 = 1
net.ipv4.conf.default.disable_ipv6 = 1

# 9 Prevent sending TCP segments with null windows
net.ipv4.tcp_rfc1337 = 1

# 10 Disable ARP filtering for automatic routing
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1

# 11 Limit the maximum size of the incoming TCP window
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# 12 Drop packets with incorrect checksums
net.ipv4.conf.all.drop_unicast_in_l2_multicast = 1
net.ipv4.conf.default.drop_unicast_in_l2_multicast = 1

# 13 Disable IPv6 forwarding
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# 14 Limit the maximum number of SYN packet retries
net.ipv4.tcp_synack_retries = 2

# 15 Increase routing cache lifetime
net.ipv4.route.max_size = 32768
</syntaxhighlight>

====== auditd rules config: ======
/etc/audit/rules.d/audit.rules

<syntaxhighlight lang="bash">
## Flush rules
-D

## Buffers
-b 8192
--backlog_wait_time 60000
-f 1

## Network audit
-a always,exit -F arch=b64 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b64 -S accept4 -F success=1 -k network_accept
-a always,exit -F arch=b32 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b32 -S accept4 -F success=1 -k network_accept

## Logging execve commands
-a always,exit -F arch=b64 -S execve -F key=exec_log

## Audit logins and sessions
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session

## sudo / su
-w /etc/sudoers -p wa -k sudo
-w /etc/sudoers.d/ -p wa -k sudo
-w /bin/su -p x -k su_cmd

## Account and configuration changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/hosts -p wa -k system_conf
-w /etc/hostname -p wa -k system_conf
-w /etc/resolv.conf -p wa -k system_conf
-w /etc/issue -p wa -k system_conf
-w /etc/network/ -p wa -k system_conf

## Time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -F key=time_change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -F key=time_change

## Audit SSH connections and changes
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /var/log/auth.log -p wa -k ssh_login

## Audit usage of remote tools (e.g., SSH, netcat)
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/nc -k nc_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/nc -k nc_process

## Audit privileged access
-a always,exit -F arch=b64 -S setuid -S setgid -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -S setgid -k privilege_escalation
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/sudoers.d/ -p wa -k sudoers_changes
-w /bin/sudo -p x -k sudo_command

## Monitor credential changes
#-w /root/.ssh/ -p wa -k ssh_keys
#-w /home/*/.ssh/ -p wa -k ssh_keys

## Audit use of remote network services
-a always,exit -F arch=b64 -S socket -F success=1 -k socket_connect
-a always,exit -F arch=b32 -S socket -F success=1 -k socket_connect

# Log package installation and removal via dpkg
-w /usr/bin/dpkg -p x
-w /usr/sbin/apt-get -p x
-w /usr/bin/apt -p x
</syntaxhighlight>

==== UsefulPrograms ====

Here is the list of programs useful for configuring and maintaining the security of Linux systems. The included programs are either open-source (the majority) or commercial, but with freely available limited features sufficient to address core security tasks (a smaller portion).

https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/UsefulPrograms

==== External Resources ====

[https://www.debian.org/doc/manuals/securing-debian-manual/index.en.html|Securing Debian Manual 3.19 — Javier Fernández-Sanguino Peña.]
This document describes security in the Debian project and in the Debian operating system. Starting with the process of securing and hardening the default Debian GNU/Linux distribution installation, it also covers some of the common tasks to set up a secure network environment using Debian GNU/Linux, gives additional information on the security tools available and talks about how security is enforced in Debian by the security and audit team.

[https://medium.com/%40ihouelecaurcy/the-complete-nftables-guide-modern-linux-firewall-mastery-79fb86894d5c|The Complete nftables Guide: Modern Linux Firewall Mastery — Ihouele Caurcy]
The definitive guide to nftables — the modern replacement for iptables, ip6tables, arptables, and ebtables. From basic concepts to enterprise-level configurations.

[https://notes.suhaib.in/docs/tech/utilities/iptables-nftables-and-you-a-friendly-guide-to-traffic-rules/|iptables, nftables, and You A Friendly Guide to Traffic Rules]
A friendly guide to iptables and nftables in Linux: explains Netfilter architecture, tables, chains and rules, with configuration examples (SSH, IP blocking, port forwarding). Covers differences between iptables and nftables, migration, and compatibility with modern firewall tools. Useful for understanding the iptables→nftables transition and practical examples.

[https://public.jdstone1.com/books_and_magazines/Computer_Books/Operating_Systems/SELinux%20System%20Administration%20(3rd%20ed).pdf|SELinux System Administration Third Edition — Sven Vermeulen.]
Implement mandatory access control to secure applications, users, and information flows on Linux.

[https://gitlab.com/apparmor/apparmor/-/wikis/home|AppArmor.]
The official wiki for the AppArmor security project on Linux. Provides guidance for users and developers, instructions for creating and managing security profiles, example access policies for applications, and best practices to protect the operating system.

[https://nallino.net/stockage/security/Linux_Mint_Security.pdf|Security, Privacy and Anonymity in Linux Mint — Michel Nallino.]
A good and comprehensive work on Linux Mint security that can also be useful for other Linux distributions.

[https://www.cisa.gov/topics/cybersecurity-best-practices|CISA — Cybersecurity Best Practices]
CISA (Certified Information Systems Auditor) provides information on cybersecurity best practices to help individuals and organizations implement preventative measures and manage cyber risks.

This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131,
it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks

[[index.php?title=Category:Security]]
[[index.php?title=Category:Hardening]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2025-12-16T17:27:35Z

Blackcat568: added list with the literature and link to the list with useful programs

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.

* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

===== Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build). =====
Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

# 1. Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.
# If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to type long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>
# Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.
# Avoid using the superuser account or sudo without a clear necessity — and never execute arbitrary scripts with sudo. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
## Always read a script fully before running it (less script.sh, cat script.sh).
## Never paste commands from untrusted or unverified sources into the terminal.
## Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
## Follow the principle of least privilege — create separate user accounts and limit access rights where possible Important: Improper or careless use of sudo and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.
# Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. You may also consider switching to SELinux. If you have difficulty configuring AppArmor or SELinux, seek help from specialists or use AI-based tools. My SELinux configuration is attached below (I use SELinux on Debian 12 — it works reliably).
# Use advanced network filtering settings: iptables or nftables, or a commercial firewall. (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#nftables config:|nftables config]]
# Configure kernel parameters for maximum security (sysctl hardening). (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#sysctl config:|sysctl config]])
# Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event). (sample [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#auditd rules config:|auditd rules config]]
# Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.
# If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.
# Follow the principle of Attack Surface Reduction (or Occam's_razor) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
## If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
## If you are certain you will never use it, remove it completely from the system.
## This practice reduces potential attack vectors and strengthens overall system security.
## Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications. Always create a full system backup before making any significant configuration changes or modifications.
# Perform regular antivirus and anti-rootkit scans of the system. In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.
# Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:
<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

'''Related Aspects of Internet Security'''

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

1. Store passwords in a reliable password manager.

'''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:

* relying on human memory, with the risk of forgetting or confusing credentials;
* storing passwords on paper media, which can be damaged, lost, or stolen;
* saving passwords in web browsers in unencrypted form;
* keeping passwords in plain text files on the desktop or in other directories without encryption;
* and similar approaches.

Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.

A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.

* Regularly create up-to-date backups of the ''encrypted'' password database.

* Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.

Additional Practical Recommendations

A password manager (for example, KeePassXC) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.

In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.

It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).

2. Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [[wikipedia:Authenticator_app|Authenticator_app]]), or a hardware security key such as a [[wikipedia:YubiKey|YubiKey]].

This is a critical cybersecurity measure — neglecting it can completely undermine all your efforts in configuring a secure Linux system.

The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:

* YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
* It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
* Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number. For now, it is one of the most reliable hardware-based options for two-factor authentication.

3. Using VPN to improve privacy and security

''If you are a private user'', you can also configure a system-wide VPN (for example, ProtonVPN) so that all device traffic is routed through it — not only browser traffic or traffic from specific applications.

Enable the “killswitch” mode and disable it only when necessary, re-enabling it immediately afterwards.

It is also recommended to periodically change VPN servers, doing so at different and unpredictable intervals.

Using a VPN increases your privacy: all of your traffic will be encrypted from observers on your local network and from your internet service provider. This makes it more difficult for an attacker to apply certain social-engineering methods based on traffic analysis, and it also helps protect your privacy in the event that your provider’s infrastructure is compromised.

''If you own a server'' and want access to it to be available only to trusted private or legal entities, while also increasing its protection against unauthorized access, you can configure the server so that SSH and other internal services are accessible exclusively through OpenVPN using TLS authentication (tls-auth / tls-crypt) and unique client certificates instead of passwords.

4. Actively study and apply artificial intelligence to improve security configurations in Debian and other Linux distributions, as well as to address related cybersecurity tasks. A lack of knowledge often becomes the weakest link; AI can provide accurate, structured recommendations interactively and help automate repetitive or complex operations.

5. If privacy is a priority, consider reducing reliance on the Google ecosystem and switching to more privacy-focused alternatives (for example, proton.me and similar services). Google provides very strong security, but its services collect extensive telemetry for analysis. While this data is encrypted and not accessible to attackers, it may still be undesirable for users who value strict privacy.

''Always verify AI-generated recommendations before applying them in production environments. Test any changes in an isolated system, review generated commands or configurations, and ensure that suggestions align with your threat model and security architecture.''

''In practice, users who effectively leverage AI tools are significantly better prepared, and the adoption of such technologies makes malicious activity considerably more difficult for attackers.''

'''''Note:''' Artificial intelligence tools are mentioned here as optional technical aids, not as an endorsement of any specific service or vendor.''

6. It is also important to consider the possibility of hardware-level attacks.

Although such attacks are significantly less common and typically require more resources than software-based attacks, they remain a potential threat. In certain scenarios, an adversary may exploit vulnerabilities in device firmware or conduct a combined attack targeting both software and hardware layers. Examples include remote injection of malicious code into the firmware of a motherboard, router, optical modem, or other hardware components.

If, after a thorough software-level audit, a security issue remains unresolved, it is advisable <nowiki>'''</nowiki>to perform a hardware-level assessment<nowiki>'''</nowiki> as well, including verification of device firmware integrity and configuration.

<blockquote>'''And most importantly — give up the illusion of complete security. We live in conditions of a severe information war, and everyone must make efforts so that malicious actors cannot freely spy on desktops and servers.'''</blockquote>

'''Examples of Deep Custom Security Configurations'''

Below are examples of strong, individualized configurations for '''SELinux''', '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

====== SELinux config: ======
<syntaxhighlight lang="terminfo">
root@user:/home/user# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
root@user:/home/user# sestatus -v
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

Process contexts:
Current context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Init context: system_u:system_r:init_t:s0
/sbin/agetty system_u:system_r:getty_t:s0

File contexts:
Controlling terminal: unconfined_u:object_r:user_devpts_t:s0
/etc/passwd system_u:object_r:etc_t:s0
/etc/shadow system_u:object_r:unlabeled_t:s0
/bin/bash system_u:object_r:shell_exec_t:s0
/bin/login system_u:object_r:login_exec_t:s0
/bin/sh system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0
/sbin/agetty system_u:object_r:getty_exec_t:s0
/sbin/init system_u:object_r:bin_t:s0 -> system_u:object_r:init_exec_t:s0
/lib/ld-linux.so.2 system_u:object_r:lib_t:s0 -> system_u:object_r:ld_so_t:s0
</syntaxhighlight>

====== nftables config: ======
<syntaxhighlight lang="bash">
#!/usr/sbin/nft -f

flush ruleset

table inet filter {

# = Main chain policy =
chain input {
type filter hook input priority 0;
policy drop;

# = Common rule set =
# 🌀 Allow loopback interface (internal system processes)
iif "lo" accept

# == 🔁 Allow established and related connections ==
ct state established,related accept

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# == 🔒 Limit the rate of NEW connections per source IP (basic anti-DDoS protection) ==
# If you experience issues with slow or failed page loads in your browser,
# try increasing the limit, for example:
# ip saddr 0.0.0.0/0 ct state new limit rate 50/second burst 100 packets accept
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == 🚫 Blocking SSDP and mDNS (local broadcast discovery protocols) ==
ip daddr 239.255.255.250 udp dport 1900 drop # ❌ SSDP (UPnP/device discovery)
ip daddr 224.0.0.251 udp dport 5353 drop # ❌ mDNS (Bonjour, Avahi)

# == 🛑 Blocking NetBIOS and LLMNR (Windows/systemd internal LAN protocols) ==
udp dport 137 drop # ❌ NetBIOS Name Service (Windows network names)
udp dport 138 drop # ❌ NetBIOS Datagram Service (LAN name discovery)
udp dport 5355 drop # ❌ LLMNR (Link-Local Multicast Name Resolution)

# = Set of blocked IP addresses and ranges =

# == 🧱 Blocking known botnets and proxy networks ==
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} log prefix "🔥 BAN: known bots " flags all
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} drop

# == 🚫 Blocking strange TCP flags (XMAS, NULL scans and others) ==
tcp flags & (fin|syn|rst|psh|ack|urg) == 0 drop # NULL scan
tcp flags & (fin|psh|urg) == (fin|psh|urg) drop # XMAS scan
tcp flags & (fin|syn) == (fin|syn) drop # SYN-ACK scan
tcp flags & (syn|rst|fin) == (syn|rst|fin) drop # Xmas scan
tcp flags & (syn|fin|rst|psh|ack) == (syn|rst|fin|ack) drop # Xmas scan

# == 🚫 Blocking fragmented packets — commonly used in filter evasion ==
ip frag-off & 0x1fff != 0 drop

# == 🔒 Blocking spoofed IP packets ==
ip saddr 127.0.0.0/8 drop # localhost
ip saddr 10.0.0.0/8 drop # private network
ip saddr 172.16.0.0/12 drop # private network
ip saddr 192.168.0.0/16 drop # private network
ip saddr 169.254.0.0/16 drop # APIPA
ip saddr 0.0.0.0/8 drop # invalid address
ip saddr 224.0.0.0/4 drop # multicast
ip saddr 240.0.0.0/5 drop # reserved
}

# = Main chain policy =
chain forward {
type filter hook forward priority 0;
policy accept;

# = Blocking various types of attacks =
# Required in chain forward only if Docker or Oracle VirtualBox is present.
# If needed — uncomment.

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
# ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
# ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
# ip protocol icmp icmp type echo-request limit rate 1/second accept
# ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
# ip protocol icmp icmp type echo-request drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports required for application operation ==
tcp dport {
53, # DNS — needed for domain name resolution
80, # HTTP — web traffic, updates and resource loading
443, # HTTPS — secure web traffic, VPN, browser
12043, # Custom 3D Application — specific client port
13000-13050 # Custom 3D Application — dynamic client port range
} accept

# == Allow UDP ports required for application operation ==
udp dport {
53, # DNS — needed for domain name resolution
443, # HTTPS via QUIC/HTTP3, browser protocols
3478, # STUN/TURN — WebRTC and video calls
3479-3481 # STUN/TURN — WebRTC and video calls
} accept

# = Blocking dangerous and unnecessary TCP/UDP ports and ranges =

# These blocklists are intended for a DESKTOP / workstation.
# They block remote access, outdated services, proxies, DBs, IoT, and ports
# often used by malware, scanners, and C2 infrastructures.
#
# ⚠ If you use the system as a SERVER, enable IP forwarding,
# or run services with internal routing
# (Docker NAT/bridge, VirtualBox host-only/bridged, VPN clients),
# carefully review the blocked ports/ranges in the forward chain —
# these services may need extra ports.
# Adjust or comment out required items if necessary.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high risk) ===
22, # SSH — common brute-force target
23, # Telnet — outdated, no encryption
3389, # RDP — Windows remote desktop
5900, # VNC — remote access, frequent vulnerabilities
# === FTP / SMB / NetBIOS (unsafe file-sharing protocols) ===
21, # FTP — insecure protocol
137, # NetBIOS Name Service
138, # NetBIOS Datagram
139, # NetBIOS Session
445, # SMB/CIFS — common exploit target
# === Databases (NEVER expose to the Internet) ===
3306, # MySQL/MariaDB
1433, # MS SQL Server
1434, # MS SQL Browser
# === HTTP-alt/Proxy/Elasticsearch (exploited frequently) ===
8080, # HTTP proxy / web interfaces — often exposed accidentally
9200, # Elasticsearch API — full remote data access
# === UPnP/IoT (insecure by design) ===
1900, # SSDP / UPnP
# === Common for malware (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell
5555, # Android ADB / IoT botnets
9001, # Tor transport (used by malware)
1234, # Netcat / reverse connections
1337, # Common C2 port used by malware
# === ⚠️ Scanner ports and potentially vulnerable services ===
1080, # SOCKS proxy — used to bypass filtering
3128, # Squid proxy — may be abused as open proxy
8000, # Alternative HTTP ports, dev servers
8888, # Web interfaces, proxies, dev tools
10000 # Webmin — remote admin panel, frequent attacks
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; abused by attackers
162 # SNMP Trap — also potentially vulnerable
} drop

# Attention! Blocking wide port ranges — be careful!
# Do not break system or application functionality!

# == TCP port ranges not used by a workstation during transit routing ==
# Blocked to prevent unwanted forwarding, hidden tunnels,
# NAT evasion, parasitic flows, and potential forward-path attacks.

tcp dport {
1024-2047, # System/legacy services; rarely needed in forward
2048-4095, # Proprietary daemons; NFS (2049) — check if used
4096-8191, # Old VPNs, some games, P2P; rarely needed on desktop
8192-12287, # Alternative HTTP/proxy, multimedia; test as needed
12288-16383, # Media/VoIP (TCP fallback); may break calls
16384-24575, # RTP/WebRTC (TCP fallback); block unless AV needed
24576-32767, # Dynamic ranges for games/VPN; may cause issues
32768-49151, # Registered/ephemeral; risky — may break NAT, Docker, VM
49152-65535 # High ephemeral; widely used by modern apps
} drop

# == 🚫 Blocking UDP ports — high and dynamic ranges ==
udp dport {
1024-9999, # low/mid ephemeral ports; used by trojans, P2P, games, VPN
10000-65535 # high ephemeral; used by dynamic apps, VPN, Docker
} drop

# = 🕷️ Suspicious IPs — large ranges often used by botnets, spam nets, and scanners =
ip saddr {
185.0.0.0/8, # abused hosting and proxy networks
37.0.0.0/8, # cheap VPS, frequent scanning sources
88.0.0.0/8, # common brute-force and scanner range
77.0.0.0/8, # TOR/proxy nodes
91.0.0.0/8 # botnets and “grey-zone” hosting
} drop
}

chain output {
# = Main chain policy =
type filter hook output priority 0;
policy accept;

# = Blocking various types of attacks =

# == 🔒 Limiting new connections from a single IP (anti-DDoS) ==
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# = ICMP protocol restrictions =

# == 🛡️ Ping limitation ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == Critically important ICMP for network ==
ip protocol icmp icmp type { destination-unreachable, time-exceeded, parameter-problem } accept

# == Important ICMPv6 for IPv6 ==
ip6 nexthdr icmpv6 icmpv6 type { 1, 2, 3, 4 } accept
ip6 nexthdr icmpv6 icmpv6 type { 135, 136 } accept # NS/NA
ip6 nexthdr icmpv6 icmpv6 type { 133, 134 } accept # RS/RA

# == Drop all other ICMP and ICMPv6 ==
ip protocol icmp drop # drop all other ICMP
ip6 nexthdr icmpv6 drop # drop all other ICMPv6

# = SCTP protocol blocking =
# 99.9% of desktop systems do not use SCTP at all
meta l4proto sctp drop

# = DCCP — Datagram Congestion Control Protocol blocking =
# Not used by any mainstream desktop applications
meta l4proto dccp drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports and ranges required for application functionality ==
tcp dport {
53, # DNS client. Required for Internet to work: domain name resolution (UDP/TCP).
80, # HTTP traffic to unencrypted websites; apps may use it for API/redirects.
443, # HTTPS. Main port for all encrypted web traffic — browsers, API, VPN, updates.
3306, # MySQL client. Needed if you connect to MySQL.
3478, # STUN/TURN WebRTC. Needed for audio/video/Discord.
3000, # Node.js dev servers. Needed for development.
3690, # SVN. If you work with an old repository.
4443, # Alternative HTTPS (some APIs). Also used by some VPN/clients.
12043, # Required for Custom 3D Application.
13000-13050 # Required for Custom 3D Application.
} accept

# == Allow UDP ports and ranges required for applications ==
udp dport {
443, # Required for fast and stable operation of modern websites
# (Google, YouTube, ChatGPT, Cloudflare)
13000-13050 # Required for Custom 3D Application.
} accept

# = Blocking potentially dangerous / unnecessary TCP/UDP ports =

# These blocks are intended for a DESKTOP / workstation.
# ⚠ If you use the system as a SERVER —
# adjust or comment out the required ports/ranges as needed.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high-risk) ===
22, # SSH — target of brute-force attacks.
23, # Telnet — outdated, unencrypted.
3389, # RDP — Windows remote access.
5900, # VNC — remote access, often vulnerable.
# === FTP / SMB / NetBIOS (dangerous file-sharing services) ===
21, # FTP — insecure protocol.
137, # NetBIOS Name Service.
138, # NetBIOS Datagram.
139, # NetBIOS Session.
445, # SMB/CIFS — frequent exploitation target.
# === Databases (NEVER open to the Internet) ===
3306, # MySQL/MariaDB.
1433, # MS SQL Server.
1434, # MS SQL Browser.
# === HTTP-alt/Proxy/Elasticsearch (dangerous, often attacked) ===
8080, # HTTP proxy / web interfaces — often exposed test interfaces.
9200, # Elasticsearch API — full remote access to data.
# === UPnP/IoT (vulnerable by design) ===
1900, # SSDP / UPnP.
# === Common malware ports (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell.
5555, # Android ADB / IoT botnets.
9001, # Tor transport (used by malware).
1234, # Netcat / reverse connections.
1337, # Common C2 malware port.
# === ⚠️ Ports of scanners and potentially vulnerable services ===
1080, # SOCKS proxy — often abused for bypassing filters.
3128, # Squid HTTP proxy — can be used as open proxy.
8000, # Alternative HTTP ports, web services — potentially vulnerable.
8888, # Alternative web interfaces — test and proxy ports.
10000 # Webmin — web admin panel, target of attacks.
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; can be abused by attackers.
162 # SNMP Trap — same, potential vulnerability.
} drop

# Warning! ⚠️ Be careful blocking wide port ranges! ⚠️
# Do not break system or application functionality!
# If you need a range — uncomment.
# If you don’t — comment out.

# == Blocking “dangerous” and desktop-unnecessary TCP port ranges ==
tcp dport {
1-1023, # 🛑 Privileged ports.
1024-2047, # r-commands (rlogin, rsh, rexec), old RPC, NFS, legacy daemons.
2048-3071, # Rare proprietary protocols and middleware.
3072-4999, # Mostly ports of legacy, server, corporate apps;
# rarely needed on workstations.
5000-5999, # Alternative services, old P2P/admin ports, rarely used on desktops.
7000-7999, # Alternative/test ports, often used by trojans.
9000-9999, # Web services, proxies, possible backdoor ports.
10000-19998, # Dynamic/high service ports; may be required by some apps like Custom 3D Application,
# but not needed by most desktop services.
19999-32767 # Old ephemeral port range; used by P2P, games, some VPNs,
# but system services rarely use them.
} drop

# == Blocking “dangerous” and desktop-unnecessary UDP port ranges ==
udp dport {
1024-2047, # Old UNIX services, RPC, NFS, r-commands, legacy daemons.
# Usually safe to block.
2048-4095, # Rarely used standard ports, proprietary services.
# Usually safe to block.
4096-8191, # VPN, games, P2P, WebRTC, VoIP of some clients.
# Can block, but cautiously: may affect VPN/apps.
8192-12287, # QUIC/HTTP3, proxies, multimedia protocols.
# Might cause side effects; better test first.
12288-16383, # Old RTP/VoIP ranges and media streams.
# Can block, but might break video calls.
16384-24575, # Main RTP range (audio/video), WebRTC, VoIP.
# ❗ Do not block if you need video calls/WebRTC/VPN.
24576-32767 # Dynamic ports for VPN, P2P, games, streaming data.
# ❗ May break VPN or some apps.
} drop

# == 🕷️ Blocking suspicious IPs —
# large ranges often used by botnets, spam networks, and scanners ==
ip saddr {
185.0.0.0/8, # Abused hosting and proxy networks.
37.0.0.0/8, # Cheap VPS, scanning sources.
88.0.0.0/8, # Frequent brute-force and scanners.
77.0.0.0/8, # Massive TOR/proxy nodes.
91.0.0.0/8 # Botnets and “grey” hosting.
} drop
}
}

</syntaxhighlight>

====== sysctl config: ======
kernel parameters configuration

/etc/sysctl.d/99-protect.conf<syntaxhighlight lang="bash">
# 1 Ignore ICMP on interfaces
net.ipv4.icmp_echo_ignore_all = 1

# 2 Do not respond to ICMP broadcast (against Smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 3 Enable SYN backlog reduction
net.ipv4.tcp_syncookies = 1

# 4 Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 5 Log packets with incorrect routing
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# 6 Disable ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# 7 Disable packet forwarding
net.ipv4.ip_forward = 0

# 8 Disable IPv6 support
net.ipv4.conf.all.disable_ipv6 = 1
net.ipv4.conf.default.disable_ipv6 = 1

# 9 Prevent sending TCP segments with null windows
net.ipv4.tcp_rfc1337 = 1

# 10 Disable ARP filtering for automatic routing
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1

# 11 Limit the maximum size of the incoming TCP window
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# 12 Drop packets with incorrect checksums
net.ipv4.conf.all.drop_unicast_in_l2_multicast = 1
net.ipv4.conf.default.drop_unicast_in_l2_multicast = 1

# 13 Disable IPv6 forwarding
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# 14 Limit the maximum number of SYN packet retries
net.ipv4.tcp_synack_retries = 2

# 15 Increase routing cache lifetime
net.ipv4.route.max_size = 32768
</syntaxhighlight>

====== auditd rules config: ======
/etc/audit/rules.d/audit.rules

<syntaxhighlight lang="bash">
## Flush rules
-D

## Buffers
-b 8192
--backlog_wait_time 60000
-f 1

## Network audit
-a always,exit -F arch=b64 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b64 -S accept4 -F success=1 -k network_accept
-a always,exit -F arch=b32 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b32 -S accept4 -F success=1 -k network_accept

## Logging execve commands
-a always,exit -F arch=b64 -S execve -F key=exec_log

## Audit logins and sessions
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session

## sudo / su
-w /etc/sudoers -p wa -k sudo
-w /etc/sudoers.d/ -p wa -k sudo
-w /bin/su -p x -k su_cmd

## Account and configuration changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/hosts -p wa -k system_conf
-w /etc/hostname -p wa -k system_conf
-w /etc/resolv.conf -p wa -k system_conf
-w /etc/issue -p wa -k system_conf
-w /etc/network/ -p wa -k system_conf

## Time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -F key=time_change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -F key=time_change

## Audit SSH connections and changes
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /var/log/auth.log -p wa -k ssh_login

## Audit usage of remote tools (e.g., SSH, netcat)
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/nc -k nc_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/nc -k nc_process

## Audit privileged access
-a always,exit -F arch=b64 -S setuid -S setgid -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -S setgid -k privilege_escalation
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/sudoers.d/ -p wa -k sudoers_changes
-w /bin/sudo -p x -k sudo_command

## Monitor credential changes
#-w /root/.ssh/ -p wa -k ssh_keys
#-w /home/*/.ssh/ -p wa -k ssh_keys

## Audit use of remote network services
-a always,exit -F arch=b64 -S socket -F success=1 -k socket_connect
-a always,exit -F arch=b32 -S socket -F success=1 -k socket_connect

# Log package installation and removal via dpkg
-w /usr/bin/dpkg -p x
-w /usr/sbin/apt-get -p x
-w /usr/bin/apt -p x
</syntaxhighlight>

==== UsefulPrograms ====

Here is the list of programs useful for configuring and maintaining the security of Linux systems. The included programs are either open-source (the majority) or commercial, but with freely available limited features sufficient to address core security tasks (a smaller portion).

https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks/UsefulPrograms#preview

==== External Resources ====

[https://www.debian.org/doc/manuals/securing-debian-manual/index.en.html|Securing Debian Manual 3.19 — Javier Fernández-Sanguino Peña.]
This document describes security in the Debian project and in the Debian operating system. Starting with the process of securing and hardening the default Debian GNU/Linux distribution installation, it also covers some of the common tasks to set up a secure network environment using Debian GNU/Linux, gives additional information on the security tools available and talks about how security is enforced in Debian by the security and audit team.

[https://medium.com/%40ihouelecaurcy/the-complete-nftables-guide-modern-linux-firewall-mastery-79fb86894d5c|The Complete nftables Guide: Modern Linux Firewall Mastery — Ihouele Caurcy]
The definitive guide to nftables — the modern replacement for iptables, ip6tables, arptables, and ebtables. From basic concepts to enterprise-level configurations.

[https://notes.suhaib.in/docs/tech/utilities/iptables-nftables-and-you-a-friendly-guide-to-traffic-rules/|iptables, nftables, and You A Friendly Guide to Traffic Rules]
A friendly guide to iptables and nftables in Linux: explains Netfilter architecture, tables, chains and rules, with configuration examples (SSH, IP blocking, port forwarding). Covers differences between iptables and nftables, migration, and compatibility with modern firewall tools. Useful for understanding the iptables→nftables transition and practical examples.

[https://public.jdstone1.com/books_and_magazines/Computer_Books/Operating_Systems/SELinux%20System%20Administration%20(3rd%20ed).pdf|SELinux System Administration Third Edition — Sven Vermeulen.]
Implement mandatory access control to secure applications, users, and information flows on Linux.

[https://gitlab.com/apparmor/apparmor/-/wikis/home|AppArmor.]
The official wiki for the AppArmor security project on Linux. Provides guidance for users and developers, instructions for creating and managing security profiles, example access policies for applications, and best practices to protect the operating system.

[https://nallino.net/stockage/security/Linux_Mint_Security.pdf|Security, Privacy and Anonymity in Linux Mint — Michel Nallino.]
A good and comprehensive work on Linux Mint security that can also be useful for other Linux distributions.

[https://www.cisa.gov/topics/cybersecurity-best-practices|CISA — Cybersecurity Best Practices]
CISA (Certified Information Systems Auditor) provides information on cybersecurity best practices to help individuals and organizations implement preventative measures and manage cyber risks.

This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131,
it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks

[[index.php?title=Category:Security]]
[[index.php?title=Category:Hardening]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2025-12-16T17:02:40Z

Blackcat568:

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.

* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

===== Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build). =====
Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

# 1. Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.
# If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to type long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>
# Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.
# Avoid using the superuser account or sudo without a clear necessity — and never execute arbitrary scripts with sudo. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
## Always read a script fully before running it (less script.sh, cat script.sh).
## Never paste commands from untrusted or unverified sources into the terminal.
## Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
## Follow the principle of least privilege — create separate user accounts and limit access rights where possible Important: Improper or careless use of sudo and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.
# Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. You may also consider switching to SELinux. If you have difficulty configuring AppArmor or SELinux, seek help from specialists or use AI-based tools. My SELinux configuration is attached below (I use SELinux on Debian 12 — it works reliably).
# Use advanced network filtering settings: iptables or nftables, or a commercial firewall. (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#nftables config:|nftables config]]
# Configure kernel parameters for maximum security (sysctl hardening). (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#sysctl config:|sysctl config]])
# Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event). (sample [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#auditd rules config:|auditd rules config]]
# Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.
# If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.
# Follow the principle of Attack Surface Reduction (or Occam's_razor) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
## If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
## If you are certain you will never use it, remove it completely from the system.
## This practice reduces potential attack vectors and strengthens overall system security.
## Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications. Always create a full system backup before making any significant configuration changes or modifications.
# Perform regular antivirus and anti-rootkit scans of the system. In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.
# Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:
<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

'''Related Aspects of Internet Security'''

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

1. Store passwords in a reliable password manager.

'''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:

* relying on human memory, with the risk of forgetting or confusing credentials;
* storing passwords on paper media, which can be damaged, lost, or stolen;
* saving passwords in web browsers in unencrypted form;
* keeping passwords in plain text files on the desktop or in other directories without encryption;
* and similar approaches.

Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.

A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.

* Regularly create up-to-date backups of the ''encrypted'' password database.

* Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.

Additional Practical Recommendations

A password manager (for example, KeePassXC) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.

In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.

It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).

2. Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [[wikipedia:Authenticator_app|Authenticator_app]]), or a hardware security key such as a [[wikipedia:YubiKey|YubiKey]].

This is a critical cybersecurity measure — neglecting it can completely undermine all your efforts in configuring a secure Linux system.

The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:

* YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
* It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
* Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number. For now, it is one of the most reliable hardware-based options for two-factor authentication.

3. Using VPN to improve privacy and security

''If you are a private user'', you can also configure a system-wide VPN (for example, ProtonVPN) so that all device traffic is routed through it — not only browser traffic or traffic from specific applications.

Enable the “killswitch” mode and disable it only when necessary, re-enabling it immediately afterwards.

It is also recommended to periodically change VPN servers, doing so at different and unpredictable intervals.

Using a VPN increases your privacy: all of your traffic will be encrypted from observers on your local network and from your internet service provider. This makes it more difficult for an attacker to apply certain social-engineering methods based on traffic analysis, and it also helps protect your privacy in the event that your provider’s infrastructure is compromised.

''If you own a server'' and want access to it to be available only to trusted private or legal entities, while also increasing its protection against unauthorized access, you can configure the server so that SSH and other internal services are accessible exclusively through OpenVPN using TLS authentication (tls-auth / tls-crypt) and unique client certificates instead of passwords.

4. Actively study and apply artificial intelligence to improve security configurations in Debian and other Linux distributions, as well as to address related cybersecurity tasks. A lack of knowledge often becomes the weakest link; AI can provide accurate, structured recommendations interactively and help automate repetitive or complex operations.

5. If privacy is a priority, consider reducing reliance on the Google ecosystem and switching to more privacy-focused alternatives (for example, proton.me and similar services). Google provides very strong security, but its services collect extensive telemetry for analysis. While this data is encrypted and not accessible to attackers, it may still be undesirable for users who value strict privacy.

''Always verify AI-generated recommendations before applying them in production environments. Test any changes in an isolated system, review generated commands or configurations, and ensure that suggestions align with your threat model and security architecture.''

''In practice, users who effectively leverage AI tools are significantly better prepared, and the adoption of such technologies makes malicious activity considerably more difficult for attackers.''

'''''Note:''' Artificial intelligence tools are mentioned here as optional technical aids, not as an endorsement of any specific service or vendor.''

6. It is also important to consider the possibility of hardware-level attacks.

Although such attacks are significantly less common and typically require more resources than software-based attacks, they remain a potential threat. In certain scenarios, an adversary may exploit vulnerabilities in device firmware or conduct a combined attack targeting both software and hardware layers. Examples include remote injection of malicious code into the firmware of a motherboard, router, optical modem, or other hardware components.

If, after a thorough software-level audit, a security issue remains unresolved, it is advisable <nowiki>'''</nowiki>to perform a hardware-level assessment<nowiki>'''</nowiki> as well, including verification of device firmware integrity and configuration.

<blockquote>'''And most importantly — give up the illusion of complete security. We live in conditions of a severe information war, and everyone must make efforts so that malicious actors cannot freely spy on desktops and servers.'''</blockquote>

'''Examples of Deep Custom Security Configurations'''

Below are examples of strong, individualized configurations for '''SELinux''', '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

====== SELinux config: ======
<syntaxhighlight lang="terminfo">
root@user:/home/user# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
root@user:/home/user# sestatus -v
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

Process contexts:
Current context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Init context: system_u:system_r:init_t:s0
/sbin/agetty system_u:system_r:getty_t:s0

File contexts:
Controlling terminal: unconfined_u:object_r:user_devpts_t:s0
/etc/passwd system_u:object_r:etc_t:s0
/etc/shadow system_u:object_r:unlabeled_t:s0
/bin/bash system_u:object_r:shell_exec_t:s0
/bin/login system_u:object_r:login_exec_t:s0
/bin/sh system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0
/sbin/agetty system_u:object_r:getty_exec_t:s0
/sbin/init system_u:object_r:bin_t:s0 -> system_u:object_r:init_exec_t:s0
/lib/ld-linux.so.2 system_u:object_r:lib_t:s0 -> system_u:object_r:ld_so_t:s0
</syntaxhighlight>

====== nftables config: ======
<syntaxhighlight lang="bash">
#!/usr/sbin/nft -f

flush ruleset

table inet filter {

# = Main chain policy =
chain input {
type filter hook input priority 0;
policy drop;

# = Common rule set =
# 🌀 Allow loopback interface (internal system processes)
iif "lo" accept

# == 🔁 Allow established and related connections ==
ct state established,related accept

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# == 🔒 Limit the rate of NEW connections per source IP (basic anti-DDoS protection) ==
# If you experience issues with slow or failed page loads in your browser,
# try increasing the limit, for example:
# ip saddr 0.0.0.0/0 ct state new limit rate 50/second burst 100 packets accept
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == 🚫 Blocking SSDP and mDNS (local broadcast discovery protocols) ==
ip daddr 239.255.255.250 udp dport 1900 drop # ❌ SSDP (UPnP/device discovery)
ip daddr 224.0.0.251 udp dport 5353 drop # ❌ mDNS (Bonjour, Avahi)

# == 🛑 Blocking NetBIOS and LLMNR (Windows/systemd internal LAN protocols) ==
udp dport 137 drop # ❌ NetBIOS Name Service (Windows network names)
udp dport 138 drop # ❌ NetBIOS Datagram Service (LAN name discovery)
udp dport 5355 drop # ❌ LLMNR (Link-Local Multicast Name Resolution)

# = Set of blocked IP addresses and ranges =

# == 🧱 Blocking known botnets and proxy networks ==
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} log prefix "🔥 BAN: known bots " flags all
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} drop

# == 🚫 Blocking strange TCP flags (XMAS, NULL scans and others) ==
tcp flags & (fin|syn|rst|psh|ack|urg) == 0 drop # NULL scan
tcp flags & (fin|psh|urg) == (fin|psh|urg) drop # XMAS scan
tcp flags & (fin|syn) == (fin|syn) drop # SYN-ACK scan
tcp flags & (syn|rst|fin) == (syn|rst|fin) drop # Xmas scan
tcp flags & (syn|fin|rst|psh|ack) == (syn|rst|fin|ack) drop # Xmas scan

# == 🚫 Blocking fragmented packets — commonly used in filter evasion ==
ip frag-off & 0x1fff != 0 drop

# == 🔒 Blocking spoofed IP packets ==
ip saddr 127.0.0.0/8 drop # localhost
ip saddr 10.0.0.0/8 drop # private network
ip saddr 172.16.0.0/12 drop # private network
ip saddr 192.168.0.0/16 drop # private network
ip saddr 169.254.0.0/16 drop # APIPA
ip saddr 0.0.0.0/8 drop # invalid address
ip saddr 224.0.0.0/4 drop # multicast
ip saddr 240.0.0.0/5 drop # reserved
}

# = Main chain policy =
chain forward {
type filter hook forward priority 0;
policy accept;

# = Blocking various types of attacks =
# Required in chain forward only if Docker or Oracle VirtualBox is present.
# If needed — uncomment.

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
# ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
# ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
# ip protocol icmp icmp type echo-request limit rate 1/second accept
# ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
# ip protocol icmp icmp type echo-request drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports required for application operation ==
tcp dport {
53, # DNS — needed for domain name resolution
80, # HTTP — web traffic, updates and resource loading
443, # HTTPS — secure web traffic, VPN, browser
12043, # Custom 3D Application — specific client port
13000-13050 # Custom 3D Application — dynamic client port range
} accept

# == Allow UDP ports required for application operation ==
udp dport {
53, # DNS — needed for domain name resolution
443, # HTTPS via QUIC/HTTP3, browser protocols
3478, # STUN/TURN — WebRTC and video calls
3479-3481 # STUN/TURN — WebRTC and video calls
} accept

# = Blocking dangerous and unnecessary TCP/UDP ports and ranges =

# These blocklists are intended for a DESKTOP / workstation.
# They block remote access, outdated services, proxies, DBs, IoT, and ports
# often used by malware, scanners, and C2 infrastructures.
#
# ⚠ If you use the system as a SERVER, enable IP forwarding,
# or run services with internal routing
# (Docker NAT/bridge, VirtualBox host-only/bridged, VPN clients),
# carefully review the blocked ports/ranges in the forward chain —
# these services may need extra ports.
# Adjust or comment out required items if necessary.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high risk) ===
22, # SSH — common brute-force target
23, # Telnet — outdated, no encryption
3389, # RDP — Windows remote desktop
5900, # VNC — remote access, frequent vulnerabilities
# === FTP / SMB / NetBIOS (unsafe file-sharing protocols) ===
21, # FTP — insecure protocol
137, # NetBIOS Name Service
138, # NetBIOS Datagram
139, # NetBIOS Session
445, # SMB/CIFS — common exploit target
# === Databases (NEVER expose to the Internet) ===
3306, # MySQL/MariaDB
1433, # MS SQL Server
1434, # MS SQL Browser
# === HTTP-alt/Proxy/Elasticsearch (exploited frequently) ===
8080, # HTTP proxy / web interfaces — often exposed accidentally
9200, # Elasticsearch API — full remote data access
# === UPnP/IoT (insecure by design) ===
1900, # SSDP / UPnP
# === Common for malware (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell
5555, # Android ADB / IoT botnets
9001, # Tor transport (used by malware)
1234, # Netcat / reverse connections
1337, # Common C2 port used by malware
# === ⚠️ Scanner ports and potentially vulnerable services ===
1080, # SOCKS proxy — used to bypass filtering
3128, # Squid proxy — may be abused as open proxy
8000, # Alternative HTTP ports, dev servers
8888, # Web interfaces, proxies, dev tools
10000 # Webmin — remote admin panel, frequent attacks
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; abused by attackers
162 # SNMP Trap — also potentially vulnerable
} drop

# Attention! Blocking wide port ranges — be careful!
# Do not break system or application functionality!

# == TCP port ranges not used by a workstation during transit routing ==
# Blocked to prevent unwanted forwarding, hidden tunnels,
# NAT evasion, parasitic flows, and potential forward-path attacks.

tcp dport {
1024-2047, # System/legacy services; rarely needed in forward
2048-4095, # Proprietary daemons; NFS (2049) — check if used
4096-8191, # Old VPNs, some games, P2P; rarely needed on desktop
8192-12287, # Alternative HTTP/proxy, multimedia; test as needed
12288-16383, # Media/VoIP (TCP fallback); may break calls
16384-24575, # RTP/WebRTC (TCP fallback); block unless AV needed
24576-32767, # Dynamic ranges for games/VPN; may cause issues
32768-49151, # Registered/ephemeral; risky — may break NAT, Docker, VM
49152-65535 # High ephemeral; widely used by modern apps
} drop

# == 🚫 Blocking UDP ports — high and dynamic ranges ==
udp dport {
1024-9999, # low/mid ephemeral ports; used by trojans, P2P, games, VPN
10000-65535 # high ephemeral; used by dynamic apps, VPN, Docker
} drop

# = 🕷️ Suspicious IPs — large ranges often used by botnets, spam nets, and scanners =
ip saddr {
185.0.0.0/8, # abused hosting and proxy networks
37.0.0.0/8, # cheap VPS, frequent scanning sources
88.0.0.0/8, # common brute-force and scanner range
77.0.0.0/8, # TOR/proxy nodes
91.0.0.0/8 # botnets and “grey-zone” hosting
} drop
}

chain output {
# = Main chain policy =
type filter hook output priority 0;
policy accept;

# = Blocking various types of attacks =

# == 🔒 Limiting new connections from a single IP (anti-DDoS) ==
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# = ICMP protocol restrictions =

# == 🛡️ Ping limitation ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == Critically important ICMP for network ==
ip protocol icmp icmp type { destination-unreachable, time-exceeded, parameter-problem } accept

# == Important ICMPv6 for IPv6 ==
ip6 nexthdr icmpv6 icmpv6 type { 1, 2, 3, 4 } accept
ip6 nexthdr icmpv6 icmpv6 type { 135, 136 } accept # NS/NA
ip6 nexthdr icmpv6 icmpv6 type { 133, 134 } accept # RS/RA

# == Drop all other ICMP and ICMPv6 ==
ip protocol icmp drop # drop all other ICMP
ip6 nexthdr icmpv6 drop # drop all other ICMPv6

# = SCTP protocol blocking =
# 99.9% of desktop systems do not use SCTP at all
meta l4proto sctp drop

# = DCCP — Datagram Congestion Control Protocol blocking =
# Not used by any mainstream desktop applications
meta l4proto dccp drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports and ranges required for application functionality ==
tcp dport {
53, # DNS client. Required for Internet to work: domain name resolution (UDP/TCP).
80, # HTTP traffic to unencrypted websites; apps may use it for API/redirects.
443, # HTTPS. Main port for all encrypted web traffic — browsers, API, VPN, updates.
3306, # MySQL client. Needed if you connect to MySQL.
3478, # STUN/TURN WebRTC. Needed for audio/video/Discord.
3000, # Node.js dev servers. Needed for development.
3690, # SVN. If you work with an old repository.
4443, # Alternative HTTPS (some APIs). Also used by some VPN/clients.
12043, # Required for Custom 3D Application.
13000-13050 # Required for Custom 3D Application.
} accept

# == Allow UDP ports and ranges required for applications ==
udp dport {
443, # Required for fast and stable operation of modern websites
# (Google, YouTube, ChatGPT, Cloudflare)
13000-13050 # Required for Custom 3D Application.
} accept

# = Blocking potentially dangerous / unnecessary TCP/UDP ports =

# These blocks are intended for a DESKTOP / workstation.
# ⚠ If you use the system as a SERVER —
# adjust or comment out the required ports/ranges as needed.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high-risk) ===
22, # SSH — target of brute-force attacks.
23, # Telnet — outdated, unencrypted.
3389, # RDP — Windows remote access.
5900, # VNC — remote access, often vulnerable.
# === FTP / SMB / NetBIOS (dangerous file-sharing services) ===
21, # FTP — insecure protocol.
137, # NetBIOS Name Service.
138, # NetBIOS Datagram.
139, # NetBIOS Session.
445, # SMB/CIFS — frequent exploitation target.
# === Databases (NEVER open to the Internet) ===
3306, # MySQL/MariaDB.
1433, # MS SQL Server.
1434, # MS SQL Browser.
# === HTTP-alt/Proxy/Elasticsearch (dangerous, often attacked) ===
8080, # HTTP proxy / web interfaces — often exposed test interfaces.
9200, # Elasticsearch API — full remote access to data.
# === UPnP/IoT (vulnerable by design) ===
1900, # SSDP / UPnP.
# === Common malware ports (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell.
5555, # Android ADB / IoT botnets.
9001, # Tor transport (used by malware).
1234, # Netcat / reverse connections.
1337, # Common C2 malware port.
# === ⚠️ Ports of scanners and potentially vulnerable services ===
1080, # SOCKS proxy — often abused for bypassing filters.
3128, # Squid HTTP proxy — can be used as open proxy.
8000, # Alternative HTTP ports, web services — potentially vulnerable.
8888, # Alternative web interfaces — test and proxy ports.
10000 # Webmin — web admin panel, target of attacks.
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; can be abused by attackers.
162 # SNMP Trap — same, potential vulnerability.
} drop

# Warning! ⚠️ Be careful blocking wide port ranges! ⚠️
# Do not break system or application functionality!
# If you need a range — uncomment.
# If you don’t — comment out.

# == Blocking “dangerous” and desktop-unnecessary TCP port ranges ==
tcp dport {
1-1023, # 🛑 Privileged ports.
1024-2047, # r-commands (rlogin, rsh, rexec), old RPC, NFS, legacy daemons.
2048-3071, # Rare proprietary protocols and middleware.
3072-4999, # Mostly ports of legacy, server, corporate apps;
# rarely needed on workstations.
5000-5999, # Alternative services, old P2P/admin ports, rarely used on desktops.
7000-7999, # Alternative/test ports, often used by trojans.
9000-9999, # Web services, proxies, possible backdoor ports.
10000-19998, # Dynamic/high service ports; may be required by some apps like Custom 3D Application,
# but not needed by most desktop services.
19999-32767 # Old ephemeral port range; used by P2P, games, some VPNs,
# but system services rarely use them.
} drop

# == Blocking “dangerous” and desktop-unnecessary UDP port ranges ==
udp dport {
1024-2047, # Old UNIX services, RPC, NFS, r-commands, legacy daemons.
# Usually safe to block.
2048-4095, # Rarely used standard ports, proprietary services.
# Usually safe to block.
4096-8191, # VPN, games, P2P, WebRTC, VoIP of some clients.
# Can block, but cautiously: may affect VPN/apps.
8192-12287, # QUIC/HTTP3, proxies, multimedia protocols.
# Might cause side effects; better test first.
12288-16383, # Old RTP/VoIP ranges and media streams.
# Can block, but might break video calls.
16384-24575, # Main RTP range (audio/video), WebRTC, VoIP.
# ❗ Do not block if you need video calls/WebRTC/VPN.
24576-32767 # Dynamic ports for VPN, P2P, games, streaming data.
# ❗ May break VPN or some apps.
} drop

# == 🕷️ Blocking suspicious IPs —
# large ranges often used by botnets, spam networks, and scanners ==
ip saddr {
185.0.0.0/8, # Abused hosting and proxy networks.
37.0.0.0/8, # Cheap VPS, scanning sources.
88.0.0.0/8, # Frequent brute-force and scanners.
77.0.0.0/8, # Massive TOR/proxy nodes.
91.0.0.0/8 # Botnets and “grey” hosting.
} drop
}
}

</syntaxhighlight>

====== sysctl config: ======
kernel parameters configuration

/etc/sysctl.d/99-protect.conf<syntaxhighlight lang="bash">
# 1 Ignore ICMP on interfaces
net.ipv4.icmp_echo_ignore_all = 1

# 2 Do not respond to ICMP broadcast (against Smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 3 Enable SYN backlog reduction
net.ipv4.tcp_syncookies = 1

# 4 Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 5 Log packets with incorrect routing
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# 6 Disable ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# 7 Disable packet forwarding
net.ipv4.ip_forward = 0

# 8 Disable IPv6 support
net.ipv4.conf.all.disable_ipv6 = 1
net.ipv4.conf.default.disable_ipv6 = 1

# 9 Prevent sending TCP segments with null windows
net.ipv4.tcp_rfc1337 = 1

# 10 Disable ARP filtering for automatic routing
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1

# 11 Limit the maximum size of the incoming TCP window
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# 12 Drop packets with incorrect checksums
net.ipv4.conf.all.drop_unicast_in_l2_multicast = 1
net.ipv4.conf.default.drop_unicast_in_l2_multicast = 1

# 13 Disable IPv6 forwarding
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# 14 Limit the maximum number of SYN packet retries
net.ipv4.tcp_synack_retries = 2

# 15 Increase routing cache lifetime
net.ipv4.route.max_size = 32768
</syntaxhighlight>

====== auditd rules config: ======
/etc/audit/rules.d/audit.rules

<syntaxhighlight lang="bash">
## Flush rules
-D

## Buffers
-b 8192
--backlog_wait_time 60000
-f 1

## Network audit
-a always,exit -F arch=b64 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b64 -S accept4 -F success=1 -k network_accept
-a always,exit -F arch=b32 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b32 -S accept4 -F success=1 -k network_accept

## Logging execve commands
-a always,exit -F arch=b64 -S execve -F key=exec_log

## Audit logins and sessions
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session

## sudo / su
-w /etc/sudoers -p wa -k sudo
-w /etc/sudoers.d/ -p wa -k sudo
-w /bin/su -p x -k su_cmd

## Account and configuration changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/hosts -p wa -k system_conf
-w /etc/hostname -p wa -k system_conf
-w /etc/resolv.conf -p wa -k system_conf
-w /etc/issue -p wa -k system_conf
-w /etc/network/ -p wa -k system_conf

## Time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -F key=time_change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -F key=time_change

## Audit SSH connections and changes
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /var/log/auth.log -p wa -k ssh_login

## Audit usage of remote tools (e.g., SSH, netcat)
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/nc -k nc_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/nc -k nc_process

## Audit privileged access
-a always,exit -F arch=b64 -S setuid -S setgid -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -S setgid -k privilege_escalation
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/sudoers.d/ -p wa -k sudoers_changes
-w /bin/sudo -p x -k sudo_command

## Monitor credential changes
#-w /root/.ssh/ -p wa -k ssh_keys
#-w /home/*/.ssh/ -p wa -k ssh_keys

## Audit use of remote network services
-a always,exit -F arch=b64 -S socket -F success=1 -k socket_connect
-a always,exit -F arch=b32 -S socket -F success=1 -k socket_connect

# Log package installation and removal via dpkg
-w /usr/bin/dpkg -p x
-w /usr/sbin/apt-get -p x
-w /usr/bin/apt -p x
</syntaxhighlight>This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131, it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks
[[index.php?title=Category:Security]]
[[index.php?title=Category:Hardening]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2025-12-16T16:02:23Z

Blackcat568: /* Security Hardening for Debian Users: Protecting Against Targeted Attacks */

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.

* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

===== Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build). =====
Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

# 1. Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.
# If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to type long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>
# Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.
# Avoid using the superuser account or sudo without a clear necessity — and never execute arbitrary scripts with sudo. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
## Always read a script fully before running it (less script.sh, cat script.sh).
## Never paste commands from untrusted or unverified sources into the terminal.
## Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
## Follow the principle of least privilege — create separate user accounts and limit access rights where possible Important: Improper or careless use of sudo and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.
# Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. You may also consider switching to SELinux. If you have difficulty configuring AppArmor or SELinux, seek help from specialists or use AI-based tools. My SELinux configuration is attached below (I use SELinux on Debian 12 — it works reliably).
# Use advanced network filtering settings: iptables or nftables, or a commercial firewall. (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#nftables config:|nftables config]]
# Configure kernel parameters for maximum security (sysctl hardening). (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#sysctl config:|sysctl config]])
# Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event). (sample [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#auditd rules config:|auditd rules config]]
# Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.
# If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.
# Follow the principle of Attack Surface Reduction (or Occam's_razor) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
## If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
## If you are certain you will never use it, remove it completely from the system.
## This practice reduces potential attack vectors and strengthens overall system security.
## Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications. Always create a full system backup before making any significant configuration changes or modifications.
# Perform regular antivirus and anti-rootkit scans of the system. In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.
# Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:
<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

'''Related Aspects of Internet Security'''

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

1. Store passwords in a reliable password manager.
'''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:

* relying on human memory, with the risk of forgetting or confusing credentials;
* storing passwords on paper media, which can be damaged, lost, or stolen;
* saving passwords in web browsers in unencrypted form;
* keeping passwords in plain text files on the desktop or in other directories without encryption;
* and similar approaches.

Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.

A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.

* Regularly create up-to-date backups of the ''encrypted'' password database.

* Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.

Additional Practical Recommendations

A password manager (for example, KeePassXC) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.

In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.

It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).

2. Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [[wikipedia:Authenticator_app|Authenticator_app]]), or a hardware security key such as a [[wikipedia:YubiKey|YubiKey]].

This is a critical cybersecurity measure — neglecting it can completely undermine all your efforts in configuring a secure Linux system.

The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:

* YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
* It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
* Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number. For now, it is one of the most reliable hardware-based options for two-factor authentication.

3. Using VPN to improve privacy and security

''If you are a private user'', you can also configure a system-wide VPN (for example, ProtonVPN) so that all device traffic is routed through it — not only browser traffic or traffic from specific applications.

Enable the “killswitch” mode and disable it only when necessary, re-enabling it immediately afterwards.

It is also recommended to periodically change VPN servers, doing so at different and unpredictable intervals.

Using a VPN increases your privacy: all of your traffic will be encrypted from observers on your local network and from your internet service provider. This makes it more difficult for an attacker to apply certain social-engineering methods based on traffic analysis, and it also helps protect your privacy in the event that your provider’s infrastructure is compromised.

''If you own a server'' and want access to it to be available only to trusted private or legal entities, while also increasing its protection against unauthorized access, you can configure the server so that SSH and other internal services are accessible exclusively through OpenVPN using TLS authentication (tls-auth / tls-crypt) and unique client certificates instead of passwords.

4. Actively study and apply artificial intelligence to improve security configurations in Debian and other Linux distributions, as well as to address related cybersecurity tasks. A lack of knowledge often becomes the weakest link; AI can provide accurate, structured recommendations interactively and help automate repetitive or complex operations.

5. If privacy is a priority, consider reducing reliance on the Google ecosystem and switching to more privacy-focused alternatives (for example, proton.me and similar services). Google provides very strong security, but its services collect extensive telemetry for analysis. While this data is encrypted and not accessible to attackers, it may still be undesirable for users who value strict privacy.

''Always verify AI-generated recommendations before applying them in production environments. Test any changes in an isolated system, review generated commands or configurations, and ensure that suggestions align with your threat model and security architecture.''

''In practice, users who effectively leverage AI tools are significantly better prepared, and the adoption of such technologies makes malicious activity considerably more difficult for attackers.''

'''''Note:''' Artificial intelligence tools are mentioned here as optional technical aids, not as an endorsement of any specific service or vendor.''

6. It is also important to consider the possibility of hardware-level attacks.

Although such attacks are significantly less common and typically require more resources than software-based attacks, they remain a potential threat. In certain scenarios, an adversary may exploit vulnerabilities in device firmware or conduct a combined attack targeting both software and hardware layers. Examples include remote injection of malicious code into the firmware of a motherboard, router, optical modem, or other hardware components.

If, after a thorough software-level audit, a security issue remains unresolved, it is advisable <nowiki>'''</nowiki>to perform a hardware-level assessment<nowiki>'''</nowiki> as well, including verification of device firmware integrity and configuration.

<blockquote>'''And most importantly — give up the illusion of complete security. We live in conditions of a severe information war, and everyone must make efforts so that malicious actors cannot freely spy on desktops and servers.'''</blockquote>

'''Examples of Deep Custom Security Configurations'''

Below are examples of strong, individualized configurations for '''SELinux''', '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

====== SELinux config: ======
<syntaxhighlight lang="terminfo">
root@user:/home/user# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
root@user:/home/user# sestatus -v
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

Process contexts:
Current context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Init context: system_u:system_r:init_t:s0
/sbin/agetty system_u:system_r:getty_t:s0

File contexts:
Controlling terminal: unconfined_u:object_r:user_devpts_t:s0
/etc/passwd system_u:object_r:etc_t:s0
/etc/shadow system_u:object_r:unlabeled_t:s0
/bin/bash system_u:object_r:shell_exec_t:s0
/bin/login system_u:object_r:login_exec_t:s0
/bin/sh system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0
/sbin/agetty system_u:object_r:getty_exec_t:s0
/sbin/init system_u:object_r:bin_t:s0 -> system_u:object_r:init_exec_t:s0
/lib/ld-linux.so.2 system_u:object_r:lib_t:s0 -> system_u:object_r:ld_so_t:s0
</syntaxhighlight>

====== nftables config: ======
<syntaxhighlight lang="bash">
#!/usr/sbin/nft -f

flush ruleset

table inet filter {

# = Main chain policy =
chain input {
type filter hook input priority 0;
policy drop;

# = Common rule set =
# 🌀 Allow loopback interface (internal system processes)
iif "lo" accept

# == 🔁 Allow established and related connections ==
ct state established,related accept

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# == 🔒 Limit the rate of NEW connections per source IP (basic anti-DDoS protection) ==
# If you experience issues with slow or failed page loads in your browser,
# try increasing the limit, for example:
# ip saddr 0.0.0.0/0 ct state new limit rate 50/second burst 100 packets accept
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == 🚫 Blocking SSDP and mDNS (local broadcast discovery protocols) ==
ip daddr 239.255.255.250 udp dport 1900 drop # ❌ SSDP (UPnP/device discovery)
ip daddr 224.0.0.251 udp dport 5353 drop # ❌ mDNS (Bonjour, Avahi)

# == 🛑 Blocking NetBIOS and LLMNR (Windows/systemd internal LAN protocols) ==
udp dport 137 drop # ❌ NetBIOS Name Service (Windows network names)
udp dport 138 drop # ❌ NetBIOS Datagram Service (LAN name discovery)
udp dport 5355 drop # ❌ LLMNR (Link-Local Multicast Name Resolution)

# = Set of blocked IP addresses and ranges =

# == 🧱 Blocking known botnets and proxy networks ==
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} log prefix "🔥 BAN: known bots " flags all
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} drop

# == 🚫 Blocking strange TCP flags (XMAS, NULL scans and others) ==
tcp flags & (fin|syn|rst|psh|ack|urg) == 0 drop # NULL scan
tcp flags & (fin|psh|urg) == (fin|psh|urg) drop # XMAS scan
tcp flags & (fin|syn) == (fin|syn) drop # SYN-ACK scan
tcp flags & (syn|rst|fin) == (syn|rst|fin) drop # Xmas scan
tcp flags & (syn|fin|rst|psh|ack) == (syn|rst|fin|ack) drop # Xmas scan

# == 🚫 Blocking fragmented packets — commonly used in filter evasion ==
ip frag-off & 0x1fff != 0 drop

# == 🔒 Blocking spoofed IP packets ==
ip saddr 127.0.0.0/8 drop # localhost
ip saddr 10.0.0.0/8 drop # private network
ip saddr 172.16.0.0/12 drop # private network
ip saddr 192.168.0.0/16 drop # private network
ip saddr 169.254.0.0/16 drop # APIPA
ip saddr 0.0.0.0/8 drop # invalid address
ip saddr 224.0.0.0/4 drop # multicast
ip saddr 240.0.0.0/5 drop # reserved
}

# = Main chain policy =
chain forward {
type filter hook forward priority 0;
policy accept;

# = Blocking various types of attacks =
# Required in chain forward only if Docker or Oracle VirtualBox is present.
# If needed — uncomment.

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
# ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
# ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
# ip protocol icmp icmp type echo-request limit rate 1/second accept
# ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
# ip protocol icmp icmp type echo-request drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports required for application operation ==
tcp dport {
53, # DNS — needed for domain name resolution
80, # HTTP — web traffic, updates and resource loading
443, # HTTPS — secure web traffic, VPN, browser
12043, # Custom 3D Application — specific client port
13000-13050 # Custom 3D Application — dynamic client port range
} accept

# == Allow UDP ports required for application operation ==
udp dport {
53, # DNS — needed for domain name resolution
443, # HTTPS via QUIC/HTTP3, browser protocols
3478, # STUN/TURN — WebRTC and video calls
3479-3481 # STUN/TURN — WebRTC and video calls
} accept

# = Blocking dangerous and unnecessary TCP/UDP ports and ranges =

# These blocklists are intended for a DESKTOP / workstation.
# They block remote access, outdated services, proxies, DBs, IoT, and ports
# often used by malware, scanners, and C2 infrastructures.
#
# ⚠ If you use the system as a SERVER, enable IP forwarding,
# or run services with internal routing
# (Docker NAT/bridge, VirtualBox host-only/bridged, VPN clients),
# carefully review the blocked ports/ranges in the forward chain —
# these services may need extra ports.
# Adjust or comment out required items if necessary.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high risk) ===
22, # SSH — common brute-force target
23, # Telnet — outdated, no encryption
3389, # RDP — Windows remote desktop
5900, # VNC — remote access, frequent vulnerabilities
# === FTP / SMB / NetBIOS (unsafe file-sharing protocols) ===
21, # FTP — insecure protocol
137, # NetBIOS Name Service
138, # NetBIOS Datagram
139, # NetBIOS Session
445, # SMB/CIFS — common exploit target
# === Databases (NEVER expose to the Internet) ===
3306, # MySQL/MariaDB
1433, # MS SQL Server
1434, # MS SQL Browser
# === HTTP-alt/Proxy/Elasticsearch (exploited frequently) ===
8080, # HTTP proxy / web interfaces — often exposed accidentally
9200, # Elasticsearch API — full remote data access
# === UPnP/IoT (insecure by design) ===
1900, # SSDP / UPnP
# === Common for malware (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell
5555, # Android ADB / IoT botnets
9001, # Tor transport (used by malware)
1234, # Netcat / reverse connections
1337, # Common C2 port used by malware
# === ⚠️ Scanner ports and potentially vulnerable services ===
1080, # SOCKS proxy — used to bypass filtering
3128, # Squid proxy — may be abused as open proxy
8000, # Alternative HTTP ports, dev servers
8888, # Web interfaces, proxies, dev tools
10000 # Webmin — remote admin panel, frequent attacks
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; abused by attackers
162 # SNMP Trap — also potentially vulnerable
} drop

# Attention! Blocking wide port ranges — be careful!
# Do not break system or application functionality!

# == TCP port ranges not used by a workstation during transit routing ==
# Blocked to prevent unwanted forwarding, hidden tunnels,
# NAT evasion, parasitic flows, and potential forward-path attacks.

tcp dport {
1024-2047, # System/legacy services; rarely needed in forward
2048-4095, # Proprietary daemons; NFS (2049) — check if used
4096-8191, # Old VPNs, some games, P2P; rarely needed on desktop
8192-12287, # Alternative HTTP/proxy, multimedia; test as needed
12288-16383, # Media/VoIP (TCP fallback); may break calls
16384-24575, # RTP/WebRTC (TCP fallback); block unless AV needed
24576-32767, # Dynamic ranges for games/VPN; may cause issues
32768-49151, # Registered/ephemeral; risky — may break NAT, Docker, VM
49152-65535 # High ephemeral; widely used by modern apps
} drop

# == 🚫 Blocking UDP ports — high and dynamic ranges ==
udp dport {
1024-9999, # low/mid ephemeral ports; used by trojans, P2P, games, VPN
10000-65535 # high ephemeral; used by dynamic apps, VPN, Docker
} drop

# = 🕷️ Suspicious IPs — large ranges often used by botnets, spam nets, and scanners =
ip saddr {
185.0.0.0/8, # abused hosting and proxy networks
37.0.0.0/8, # cheap VPS, frequent scanning sources
88.0.0.0/8, # common brute-force and scanner range
77.0.0.0/8, # TOR/proxy nodes
91.0.0.0/8 # botnets and “grey-zone” hosting
} drop
}

chain output {
# = Main chain policy =
type filter hook output priority 0;
policy accept;

# = Blocking various types of attacks =

# == 🔒 Limiting new connections from a single IP (anti-DDoS) ==
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# = ICMP protocol restrictions =

# == 🛡️ Ping limitation ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == Critically important ICMP for network ==
ip protocol icmp icmp type { destination-unreachable, time-exceeded, parameter-problem } accept

# == Important ICMPv6 for IPv6 ==
ip6 nexthdr icmpv6 icmpv6 type { 1, 2, 3, 4 } accept
ip6 nexthdr icmpv6 icmpv6 type { 135, 136 } accept # NS/NA
ip6 nexthdr icmpv6 icmpv6 type { 133, 134 } accept # RS/RA

# == Drop all other ICMP and ICMPv6 ==
ip protocol icmp drop # drop all other ICMP
ip6 nexthdr icmpv6 drop # drop all other ICMPv6

# = SCTP protocol blocking =
# 99.9% of desktop systems do not use SCTP at all
meta l4proto sctp drop

# = DCCP — Datagram Congestion Control Protocol blocking =
# Not used by any mainstream desktop applications
meta l4proto dccp drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports and ranges required for application functionality ==
tcp dport {
53, # DNS client. Required for Internet to work: domain name resolution (UDP/TCP).
80, # HTTP traffic to unencrypted websites; apps may use it for API/redirects.
443, # HTTPS. Main port for all encrypted web traffic — browsers, API, VPN, updates.
3306, # MySQL client. Needed if you connect to MySQL.
3478, # STUN/TURN WebRTC. Needed for audio/video/Discord.
3000, # Node.js dev servers. Needed for development.
3690, # SVN. If you work with an old repository.
4443, # Alternative HTTPS (some APIs). Also used by some VPN/clients.
12043, # Required for Custom 3D Application.
13000-13050 # Required for Custom 3D Application.
} accept

# == Allow UDP ports and ranges required for applications ==
udp dport {
443, # Required for fast and stable operation of modern websites
# (Google, YouTube, ChatGPT, Cloudflare)
13000-13050 # Required for Custom 3D Application.
} accept

# = Blocking potentially dangerous / unnecessary TCP/UDP ports =

# These blocks are intended for a DESKTOP / workstation.
# ⚠ If you use the system as a SERVER —
# adjust or comment out the required ports/ranges as needed.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high-risk) ===
22, # SSH — target of brute-force attacks.
23, # Telnet — outdated, unencrypted.
3389, # RDP — Windows remote access.
5900, # VNC — remote access, often vulnerable.
# === FTP / SMB / NetBIOS (dangerous file-sharing services) ===
21, # FTP — insecure protocol.
137, # NetBIOS Name Service.
138, # NetBIOS Datagram.
139, # NetBIOS Session.
445, # SMB/CIFS — frequent exploitation target.
# === Databases (NEVER open to the Internet) ===
3306, # MySQL/MariaDB.
1433, # MS SQL Server.
1434, # MS SQL Browser.
# === HTTP-alt/Proxy/Elasticsearch (dangerous, often attacked) ===
8080, # HTTP proxy / web interfaces — often exposed test interfaces.
9200, # Elasticsearch API — full remote access to data.
# === UPnP/IoT (vulnerable by design) ===
1900, # SSDP / UPnP.
# === Common malware ports (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell.
5555, # Android ADB / IoT botnets.
9001, # Tor transport (used by malware).
1234, # Netcat / reverse connections.
1337, # Common C2 malware port.
# === ⚠️ Ports of scanners and potentially vulnerable services ===
1080, # SOCKS proxy — often abused for bypassing filters.
3128, # Squid HTTP proxy — can be used as open proxy.
8000, # Alternative HTTP ports, web services — potentially vulnerable.
8888, # Alternative web interfaces — test and proxy ports.
10000 # Webmin — web admin panel, target of attacks.
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; can be abused by attackers.
162 # SNMP Trap — same, potential vulnerability.
} drop

# Warning! ⚠️ Be careful blocking wide port ranges! ⚠️
# Do not break system or application functionality!
# If you need a range — uncomment.
# If you don’t — comment out.

# == Blocking “dangerous” and desktop-unnecessary TCP port ranges ==
tcp dport {
1-1023, # 🛑 Privileged ports.
1024-2047, # r-commands (rlogin, rsh, rexec), old RPC, NFS, legacy daemons.
2048-3071, # Rare proprietary protocols and middleware.
3072-4999, # Mostly ports of legacy, server, corporate apps;
# rarely needed on workstations.
5000-5999, # Alternative services, old P2P/admin ports, rarely used on desktops.
7000-7999, # Alternative/test ports, often used by trojans.
9000-9999, # Web services, proxies, possible backdoor ports.
10000-19998, # Dynamic/high service ports; may be required by some apps like Custom 3D Application,
# but not needed by most desktop services.
19999-32767 # Old ephemeral port range; used by P2P, games, some VPNs,
# but system services rarely use them.
} drop

# == Blocking “dangerous” and desktop-unnecessary UDP port ranges ==
udp dport {
1024-2047, # Old UNIX services, RPC, NFS, r-commands, legacy daemons.
# Usually safe to block.
2048-4095, # Rarely used standard ports, proprietary services.
# Usually safe to block.
4096-8191, # VPN, games, P2P, WebRTC, VoIP of some clients.
# Can block, but cautiously: may affect VPN/apps.
8192-12287, # QUIC/HTTP3, proxies, multimedia protocols.
# Might cause side effects; better test first.
12288-16383, # Old RTP/VoIP ranges and media streams.
# Can block, but might break video calls.
16384-24575, # Main RTP range (audio/video), WebRTC, VoIP.
# ❗ Do not block if you need video calls/WebRTC/VPN.
24576-32767 # Dynamic ports for VPN, P2P, games, streaming data.
# ❗ May break VPN or some apps.
} drop

# == 🕷️ Blocking suspicious IPs —
# large ranges often used by botnets, spam networks, and scanners ==
ip saddr {
185.0.0.0/8, # Abused hosting and proxy networks.
37.0.0.0/8, # Cheap VPS, scanning sources.
88.0.0.0/8, # Frequent brute-force and scanners.
77.0.0.0/8, # Massive TOR/proxy nodes.
91.0.0.0/8 # Botnets and “grey” hosting.
} drop
}
}

</syntaxhighlight>

====== sysctl config: ======
kernel parameters configuration

/etc/sysctl.d/99-protect.conf<syntaxhighlight lang="bash">
# 1 Ignore ICMP on interfaces
net.ipv4.icmp_echo_ignore_all = 1

# 2 Do not respond to ICMP broadcast (against Smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 3 Enable SYN backlog reduction
net.ipv4.tcp_syncookies = 1

# 4 Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 5 Log packets with incorrect routing
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# 6 Disable ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# 7 Disable packet forwarding
net.ipv4.ip_forward = 0

# 8 Disable IPv6 support
net.ipv4.conf.all.disable_ipv6 = 1
net.ipv4.conf.default.disable_ipv6 = 1

# 9 Prevent sending TCP segments with null windows
net.ipv4.tcp_rfc1337 = 1

# 10 Disable ARP filtering for automatic routing
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1

# 11 Limit the maximum size of the incoming TCP window
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# 12 Drop packets with incorrect checksums
net.ipv4.conf.all.drop_unicast_in_l2_multicast = 1
net.ipv4.conf.default.drop_unicast_in_l2_multicast = 1

# 13 Disable IPv6 forwarding
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# 14 Limit the maximum number of SYN packet retries
net.ipv4.tcp_synack_retries = 2

# 15 Increase routing cache lifetime
net.ipv4.route.max_size = 32768
</syntaxhighlight>

====== auditd rules config: ======
/etc/audit/rules.d/audit.rules

<syntaxhighlight lang="bash">
## Flush rules
-D

## Buffers
-b 8192
--backlog_wait_time 60000
-f 1

## Network audit
-a always,exit -F arch=b64 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b64 -S accept4 -F success=1 -k network_accept
-a always,exit -F arch=b32 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b32 -S accept4 -F success=1 -k network_accept

## Logging execve commands
-a always,exit -F arch=b64 -S execve -F key=exec_log

## Audit logins and sessions
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session

## sudo / su
-w /etc/sudoers -p wa -k sudo
-w /etc/sudoers.d/ -p wa -k sudo
-w /bin/su -p x -k su_cmd

## Account and configuration changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/hosts -p wa -k system_conf
-w /etc/hostname -p wa -k system_conf
-w /etc/resolv.conf -p wa -k system_conf
-w /etc/issue -p wa -k system_conf
-w /etc/network/ -p wa -k system_conf

## Time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -F key=time_change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -F key=time_change

## Audit SSH connections and changes
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /var/log/auth.log -p wa -k ssh_login

## Audit usage of remote tools (e.g., SSH, netcat)
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/nc -k nc_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/nc -k nc_process

## Audit privileged access
-a always,exit -F arch=b64 -S setuid -S setgid -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -S setgid -k privilege_escalation
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/sudoers.d/ -p wa -k sudoers_changes
-w /bin/sudo -p x -k sudo_command

## Monitor credential changes
#-w /root/.ssh/ -p wa -k ssh_keys
#-w /home/*/.ssh/ -p wa -k ssh_keys

## Audit use of remote network services
-a always,exit -F arch=b64 -S socket -F success=1 -k socket_connect
-a always,exit -F arch=b32 -S socket -F success=1 -k socket_connect

# Log package installation and removal via dpkg
-w /usr/bin/dpkg -p x
-w /usr/sbin/apt-get -p x
-w /usr/bin/apt -p x
</syntaxhighlight>This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131, it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks
[[index.php?title=Category:Security]]
[[index.php?title=Category:Hardening]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2025-12-16T15:59:05Z

Blackcat568:

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.

* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

===== Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build). =====
Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

# 1. Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.
# If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to type long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>
# Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.
# Avoid using the superuser account or sudo without a clear necessity — and never execute arbitrary scripts with sudo. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
## Always read a script fully before running it (less script.sh, cat script.sh).
## Never paste commands from untrusted or unverified sources into the terminal.
## Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
## Follow the principle of least privilege — create separate user accounts and limit access rights where possible Important: Improper or careless use of sudo and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.
# Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. You may also consider switching to SELinux. If you have difficulty configuring AppArmor or SELinux, seek help from specialists or use AI-based tools. My SELinux configuration is attached below (I use SELinux on Debian 12 — it works reliably).
# Use advanced network filtering settings: iptables or nftables, or a commercial firewall. (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#nftables config:|nftables config]]
# Configure kernel parameters for maximum security (sysctl hardening). (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#sysctl config:|sysctl config]])
# Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event). (sample [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#auditd rules config:|auditd rules config]]
# Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.
# If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.
# Follow the principle of Attack Surface Reduction (or Occam's_razor) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
## If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
## If you are certain you will never use it, remove it completely from the system.
## This practice reduces potential attack vectors and strengthens overall system security.
## Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications. Always create a full system backup before making any significant configuration changes or modifications.
# Perform regular antivirus and anti-rootkit scans of the system. In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.
# Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:
<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

'''Related Aspects of Internet Security'''

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

1. Store passwords in a reliable password manager.
'''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:

* relying on human memory, with the risk of forgetting or confusing credentials;
* storing passwords on paper media, which can be damaged, lost, or stolen;
* saving passwords in web browsers in unencrypted form;
* keeping passwords in plain text files on the desktop or in other directories without encryption;
* and similar approaches.

Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.

A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.

Regularly create up-to-date backups of the ''encrypted'' password database.

Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.

Additional Practical Recommendations

A password manager (for example, KeePassXC) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.

In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.

It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).

2. Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [[wikipedia:Authenticator_app|Authenticator_app]]), or a hardware security key such as a [[wikipedia:YubiKey|YubiKey]].

This is a critical cybersecurity measure — neglecting it can completely undermine all your efforts in configuring a secure Linux system.

The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:

* YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
* It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
* Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number. For now, it is one of the most reliable hardware-based options for two-factor authentication.

3. Using VPN to improve privacy and security

''If you are a private user'', you can also configure a system-wide VPN (for example, ProtonVPN) so that all device traffic is routed through it — not only browser traffic or traffic from specific applications.

Enable the “killswitch” mode and disable it only when necessary, re-enabling it immediately afterwards.

It is also recommended to periodically change VPN servers, doing so at different and unpredictable intervals.

Using a VPN increases your privacy: all of your traffic will be encrypted from observers on your local network and from your internet service provider. This makes it more difficult for an attacker to apply certain social-engineering methods based on traffic analysis, and it also helps protect your privacy in the event that your provider’s infrastructure is compromised.

''If you own a server'' and want access to it to be available only to trusted private or legal entities, while also increasing its protection against unauthorized access, you can configure the server so that SSH and other internal services are accessible exclusively through OpenVPN using TLS authentication (tls-auth / tls-crypt) and unique client certificates instead of passwords.

4. Actively study and apply artificial intelligence to improve security configurations in Debian and other Linux distributions, as well as to address related cybersecurity tasks. A lack of knowledge often becomes the weakest link; AI can provide accurate, structured recommendations interactively and help automate repetitive or complex operations.

5. If privacy is a priority, consider reducing reliance on the Google ecosystem and switching to more privacy-focused alternatives (for example, proton.me and similar services). Google provides very strong security, but its services collect extensive telemetry for analysis. While this data is encrypted and not accessible to attackers, it may still be undesirable for users who value strict privacy.

''Always verify AI-generated recommendations before applying them in production environments. Test any changes in an isolated system, review generated commands or configurations, and ensure that suggestions align with your threat model and security architecture.''

''In practice, users who effectively leverage AI tools are significantly better prepared, and the adoption of such technologies makes malicious activity considerably more difficult for attackers.''

'''''Note:''' Artificial intelligence tools are mentioned here as optional technical aids, not as an endorsement of any specific service or vendor.''

6. It is also important to consider the possibility of hardware-level attacks.

Although such attacks are significantly less common and typically require more resources than software-based attacks, they remain a potential threat. In certain scenarios, an adversary may exploit vulnerabilities in device firmware or conduct a combined attack targeting both software and hardware layers. Examples include remote injection of malicious code into the firmware of a motherboard, router, optical modem, or other hardware components.

If, after a thorough software-level audit, a security issue remains unresolved, it is advisable <nowiki>'''</nowiki>to perform a hardware-level assessment<nowiki>'''</nowiki> as well, including verification of device firmware integrity and configuration.

<blockquote>'''And most importantly — give up the illusion of complete security. We live in conditions of a severe information war, and everyone must make efforts so that malicious actors cannot freely spy on desktops and servers.'''</blockquote>

'''Examples of Deep Custom Security Configurations'''

Below are examples of strong, individualized configurations for '''SELinux''', '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

====== SELinux config: ======
<syntaxhighlight lang="terminfo">
root@user:/home/user# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
root@user:/home/user# sestatus -v
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

Process contexts:
Current context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Init context: system_u:system_r:init_t:s0
/sbin/agetty system_u:system_r:getty_t:s0

File contexts:
Controlling terminal: unconfined_u:object_r:user_devpts_t:s0
/etc/passwd system_u:object_r:etc_t:s0
/etc/shadow system_u:object_r:unlabeled_t:s0
/bin/bash system_u:object_r:shell_exec_t:s0
/bin/login system_u:object_r:login_exec_t:s0
/bin/sh system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0
/sbin/agetty system_u:object_r:getty_exec_t:s0
/sbin/init system_u:object_r:bin_t:s0 -> system_u:object_r:init_exec_t:s0
/lib/ld-linux.so.2 system_u:object_r:lib_t:s0 -> system_u:object_r:ld_so_t:s0
</syntaxhighlight>

====== nftables config: ======
<syntaxhighlight lang="bash">
#!/usr/sbin/nft -f

flush ruleset

table inet filter {

# = Main chain policy =
chain input {
type filter hook input priority 0;
policy drop;

# = Common rule set =
# 🌀 Allow loopback interface (internal system processes)
iif "lo" accept

# == 🔁 Allow established and related connections ==
ct state established,related accept

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# == 🔒 Limit the rate of NEW connections per source IP (basic anti-DDoS protection) ==
# If you experience issues with slow or failed page loads in your browser,
# try increasing the limit, for example:
# ip saddr 0.0.0.0/0 ct state new limit rate 50/second burst 100 packets accept
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == 🚫 Blocking SSDP and mDNS (local broadcast discovery protocols) ==
ip daddr 239.255.255.250 udp dport 1900 drop # ❌ SSDP (UPnP/device discovery)
ip daddr 224.0.0.251 udp dport 5353 drop # ❌ mDNS (Bonjour, Avahi)

# == 🛑 Blocking NetBIOS and LLMNR (Windows/systemd internal LAN protocols) ==
udp dport 137 drop # ❌ NetBIOS Name Service (Windows network names)
udp dport 138 drop # ❌ NetBIOS Datagram Service (LAN name discovery)
udp dport 5355 drop # ❌ LLMNR (Link-Local Multicast Name Resolution)

# = Set of blocked IP addresses and ranges =

# == 🧱 Blocking known botnets and proxy networks ==
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} log prefix "🔥 BAN: known bots " flags all
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} drop

# == 🚫 Blocking strange TCP flags (XMAS, NULL scans and others) ==
tcp flags & (fin|syn|rst|psh|ack|urg) == 0 drop # NULL scan
tcp flags & (fin|psh|urg) == (fin|psh|urg) drop # XMAS scan
tcp flags & (fin|syn) == (fin|syn) drop # SYN-ACK scan
tcp flags & (syn|rst|fin) == (syn|rst|fin) drop # Xmas scan
tcp flags & (syn|fin|rst|psh|ack) == (syn|rst|fin|ack) drop # Xmas scan

# == 🚫 Blocking fragmented packets — commonly used in filter evasion ==
ip frag-off & 0x1fff != 0 drop

# == 🔒 Blocking spoofed IP packets ==
ip saddr 127.0.0.0/8 drop # localhost
ip saddr 10.0.0.0/8 drop # private network
ip saddr 172.16.0.0/12 drop # private network
ip saddr 192.168.0.0/16 drop # private network
ip saddr 169.254.0.0/16 drop # APIPA
ip saddr 0.0.0.0/8 drop # invalid address
ip saddr 224.0.0.0/4 drop # multicast
ip saddr 240.0.0.0/5 drop # reserved
}

# = Main chain policy =
chain forward {
type filter hook forward priority 0;
policy accept;

# = Blocking various types of attacks =
# Required in chain forward only if Docker or Oracle VirtualBox is present.
# If needed — uncomment.

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
# ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
# ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
# ip protocol icmp icmp type echo-request limit rate 1/second accept
# ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
# ip protocol icmp icmp type echo-request drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports required for application operation ==
tcp dport {
53, # DNS — needed for domain name resolution
80, # HTTP — web traffic, updates and resource loading
443, # HTTPS — secure web traffic, VPN, browser
12043, # Custom 3D Application — specific client port
13000-13050 # Custom 3D Application — dynamic client port range
} accept

# == Allow UDP ports required for application operation ==
udp dport {
53, # DNS — needed for domain name resolution
443, # HTTPS via QUIC/HTTP3, browser protocols
3478, # STUN/TURN — WebRTC and video calls
3479-3481 # STUN/TURN — WebRTC and video calls
} accept

# = Blocking dangerous and unnecessary TCP/UDP ports and ranges =

# These blocklists are intended for a DESKTOP / workstation.
# They block remote access, outdated services, proxies, DBs, IoT, and ports
# often used by malware, scanners, and C2 infrastructures.
#
# ⚠ If you use the system as a SERVER, enable IP forwarding,
# or run services with internal routing
# (Docker NAT/bridge, VirtualBox host-only/bridged, VPN clients),
# carefully review the blocked ports/ranges in the forward chain —
# these services may need extra ports.
# Adjust or comment out required items if necessary.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high risk) ===
22, # SSH — common brute-force target
23, # Telnet — outdated, no encryption
3389, # RDP — Windows remote desktop
5900, # VNC — remote access, frequent vulnerabilities
# === FTP / SMB / NetBIOS (unsafe file-sharing protocols) ===
21, # FTP — insecure protocol
137, # NetBIOS Name Service
138, # NetBIOS Datagram
139, # NetBIOS Session
445, # SMB/CIFS — common exploit target
# === Databases (NEVER expose to the Internet) ===
3306, # MySQL/MariaDB
1433, # MS SQL Server
1434, # MS SQL Browser
# === HTTP-alt/Proxy/Elasticsearch (exploited frequently) ===
8080, # HTTP proxy / web interfaces — often exposed accidentally
9200, # Elasticsearch API — full remote data access
# === UPnP/IoT (insecure by design) ===
1900, # SSDP / UPnP
# === Common for malware (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell
5555, # Android ADB / IoT botnets
9001, # Tor transport (used by malware)
1234, # Netcat / reverse connections
1337, # Common C2 port used by malware
# === ⚠️ Scanner ports and potentially vulnerable services ===
1080, # SOCKS proxy — used to bypass filtering
3128, # Squid proxy — may be abused as open proxy
8000, # Alternative HTTP ports, dev servers
8888, # Web interfaces, proxies, dev tools
10000 # Webmin — remote admin panel, frequent attacks
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; abused by attackers
162 # SNMP Trap — also potentially vulnerable
} drop

# Attention! Blocking wide port ranges — be careful!
# Do not break system or application functionality!

# == TCP port ranges not used by a workstation during transit routing ==
# Blocked to prevent unwanted forwarding, hidden tunnels,
# NAT evasion, parasitic flows, and potential forward-path attacks.

tcp dport {
1024-2047, # System/legacy services; rarely needed in forward
2048-4095, # Proprietary daemons; NFS (2049) — check if used
4096-8191, # Old VPNs, some games, P2P; rarely needed on desktop
8192-12287, # Alternative HTTP/proxy, multimedia; test as needed
12288-16383, # Media/VoIP (TCP fallback); may break calls
16384-24575, # RTP/WebRTC (TCP fallback); block unless AV needed
24576-32767, # Dynamic ranges for games/VPN; may cause issues
32768-49151, # Registered/ephemeral; risky — may break NAT, Docker, VM
49152-65535 # High ephemeral; widely used by modern apps
} drop

# == 🚫 Blocking UDP ports — high and dynamic ranges ==
udp dport {
1024-9999, # low/mid ephemeral ports; used by trojans, P2P, games, VPN
10000-65535 # high ephemeral; used by dynamic apps, VPN, Docker
} drop

# = 🕷️ Suspicious IPs — large ranges often used by botnets, spam nets, and scanners =
ip saddr {
185.0.0.0/8, # abused hosting and proxy networks
37.0.0.0/8, # cheap VPS, frequent scanning sources
88.0.0.0/8, # common brute-force and scanner range
77.0.0.0/8, # TOR/proxy nodes
91.0.0.0/8 # botnets and “grey-zone” hosting
} drop
}

chain output {
# = Main chain policy =
type filter hook output priority 0;
policy accept;

# = Blocking various types of attacks =

# == 🔒 Limiting new connections from a single IP (anti-DDoS) ==
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# = ICMP protocol restrictions =

# == 🛡️ Ping limitation ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == Critically important ICMP for network ==
ip protocol icmp icmp type { destination-unreachable, time-exceeded, parameter-problem } accept

# == Important ICMPv6 for IPv6 ==
ip6 nexthdr icmpv6 icmpv6 type { 1, 2, 3, 4 } accept
ip6 nexthdr icmpv6 icmpv6 type { 135, 136 } accept # NS/NA
ip6 nexthdr icmpv6 icmpv6 type { 133, 134 } accept # RS/RA

# == Drop all other ICMP and ICMPv6 ==
ip protocol icmp drop # drop all other ICMP
ip6 nexthdr icmpv6 drop # drop all other ICMPv6

# = SCTP protocol blocking =
# 99.9% of desktop systems do not use SCTP at all
meta l4proto sctp drop

# = DCCP — Datagram Congestion Control Protocol blocking =
# Not used by any mainstream desktop applications
meta l4proto dccp drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports and ranges required for application functionality ==
tcp dport {
53, # DNS client. Required for Internet to work: domain name resolution (UDP/TCP).
80, # HTTP traffic to unencrypted websites; apps may use it for API/redirects.
443, # HTTPS. Main port for all encrypted web traffic — browsers, API, VPN, updates.
3306, # MySQL client. Needed if you connect to MySQL.
3478, # STUN/TURN WebRTC. Needed for audio/video/Discord.
3000, # Node.js dev servers. Needed for development.
3690, # SVN. If you work with an old repository.
4443, # Alternative HTTPS (some APIs). Also used by some VPN/clients.
12043, # Required for Custom 3D Application.
13000-13050 # Required for Custom 3D Application.
} accept

# == Allow UDP ports and ranges required for applications ==
udp dport {
443, # Required for fast and stable operation of modern websites
# (Google, YouTube, ChatGPT, Cloudflare)
13000-13050 # Required for Custom 3D Application.
} accept

# = Blocking potentially dangerous / unnecessary TCP/UDP ports =

# These blocks are intended for a DESKTOP / workstation.
# ⚠ If you use the system as a SERVER —
# adjust or comment out the required ports/ranges as needed.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high-risk) ===
22, # SSH — target of brute-force attacks.
23, # Telnet — outdated, unencrypted.
3389, # RDP — Windows remote access.
5900, # VNC — remote access, often vulnerable.
# === FTP / SMB / NetBIOS (dangerous file-sharing services) ===
21, # FTP — insecure protocol.
137, # NetBIOS Name Service.
138, # NetBIOS Datagram.
139, # NetBIOS Session.
445, # SMB/CIFS — frequent exploitation target.
# === Databases (NEVER open to the Internet) ===
3306, # MySQL/MariaDB.
1433, # MS SQL Server.
1434, # MS SQL Browser.
# === HTTP-alt/Proxy/Elasticsearch (dangerous, often attacked) ===
8080, # HTTP proxy / web interfaces — often exposed test interfaces.
9200, # Elasticsearch API — full remote access to data.
# === UPnP/IoT (vulnerable by design) ===
1900, # SSDP / UPnP.
# === Common malware ports (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell.
5555, # Android ADB / IoT botnets.
9001, # Tor transport (used by malware).
1234, # Netcat / reverse connections.
1337, # Common C2 malware port.
# === ⚠️ Ports of scanners and potentially vulnerable services ===
1080, # SOCKS proxy — often abused for bypassing filters.
3128, # Squid HTTP proxy — can be used as open proxy.
8000, # Alternative HTTP ports, web services — potentially vulnerable.
8888, # Alternative web interfaces — test and proxy ports.
10000 # Webmin — web admin panel, target of attacks.
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; can be abused by attackers.
162 # SNMP Trap — same, potential vulnerability.
} drop

# Warning! ⚠️ Be careful blocking wide port ranges! ⚠️
# Do not break system or application functionality!
# If you need a range — uncomment.
# If you don’t — comment out.

# == Blocking “dangerous” and desktop-unnecessary TCP port ranges ==
tcp dport {
1-1023, # 🛑 Privileged ports.
1024-2047, # r-commands (rlogin, rsh, rexec), old RPC, NFS, legacy daemons.
2048-3071, # Rare proprietary protocols and middleware.
3072-4999, # Mostly ports of legacy, server, corporate apps;
# rarely needed on workstations.
5000-5999, # Alternative services, old P2P/admin ports, rarely used on desktops.
7000-7999, # Alternative/test ports, often used by trojans.
9000-9999, # Web services, proxies, possible backdoor ports.
10000-19998, # Dynamic/high service ports; may be required by some apps like Custom 3D Application,
# but not needed by most desktop services.
19999-32767 # Old ephemeral port range; used by P2P, games, some VPNs,
# but system services rarely use them.
} drop

# == Blocking “dangerous” and desktop-unnecessary UDP port ranges ==
udp dport {
1024-2047, # Old UNIX services, RPC, NFS, r-commands, legacy daemons.
# Usually safe to block.
2048-4095, # Rarely used standard ports, proprietary services.
# Usually safe to block.
4096-8191, # VPN, games, P2P, WebRTC, VoIP of some clients.
# Can block, but cautiously: may affect VPN/apps.
8192-12287, # QUIC/HTTP3, proxies, multimedia protocols.
# Might cause side effects; better test first.
12288-16383, # Old RTP/VoIP ranges and media streams.
# Can block, but might break video calls.
16384-24575, # Main RTP range (audio/video), WebRTC, VoIP.
# ❗ Do not block if you need video calls/WebRTC/VPN.
24576-32767 # Dynamic ports for VPN, P2P, games, streaming data.
# ❗ May break VPN or some apps.
} drop

# == 🕷️ Blocking suspicious IPs —
# large ranges often used by botnets, spam networks, and scanners ==
ip saddr {
185.0.0.0/8, # Abused hosting and proxy networks.
37.0.0.0/8, # Cheap VPS, scanning sources.
88.0.0.0/8, # Frequent brute-force and scanners.
77.0.0.0/8, # Massive TOR/proxy nodes.
91.0.0.0/8 # Botnets and “grey” hosting.
} drop
}
}

</syntaxhighlight>

====== sysctl config: ======
kernel parameters configuration

/etc/sysctl.d/99-protect.conf<syntaxhighlight lang="bash">
# 1 Ignore ICMP on interfaces
net.ipv4.icmp_echo_ignore_all = 1

# 2 Do not respond to ICMP broadcast (against Smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 3 Enable SYN backlog reduction
net.ipv4.tcp_syncookies = 1

# 4 Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 5 Log packets with incorrect routing
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# 6 Disable ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# 7 Disable packet forwarding
net.ipv4.ip_forward = 0

# 8 Disable IPv6 support
net.ipv4.conf.all.disable_ipv6 = 1
net.ipv4.conf.default.disable_ipv6 = 1

# 9 Prevent sending TCP segments with null windows
net.ipv4.tcp_rfc1337 = 1

# 10 Disable ARP filtering for automatic routing
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1

# 11 Limit the maximum size of the incoming TCP window
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# 12 Drop packets with incorrect checksums
net.ipv4.conf.all.drop_unicast_in_l2_multicast = 1
net.ipv4.conf.default.drop_unicast_in_l2_multicast = 1

# 13 Disable IPv6 forwarding
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# 14 Limit the maximum number of SYN packet retries
net.ipv4.tcp_synack_retries = 2

# 15 Increase routing cache lifetime
net.ipv4.route.max_size = 32768
</syntaxhighlight>

====== auditd rules config: ======
/etc/audit/rules.d/audit.rules

<syntaxhighlight lang="bash">
## Flush rules
-D

## Buffers
-b 8192
--backlog_wait_time 60000
-f 1

## Network audit
-a always,exit -F arch=b64 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b64 -S accept4 -F success=1 -k network_accept
-a always,exit -F arch=b32 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b32 -S accept4 -F success=1 -k network_accept

## Logging execve commands
-a always,exit -F arch=b64 -S execve -F key=exec_log

## Audit logins and sessions
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session

## sudo / su
-w /etc/sudoers -p wa -k sudo
-w /etc/sudoers.d/ -p wa -k sudo
-w /bin/su -p x -k su_cmd

## Account and configuration changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/hosts -p wa -k system_conf
-w /etc/hostname -p wa -k system_conf
-w /etc/resolv.conf -p wa -k system_conf
-w /etc/issue -p wa -k system_conf
-w /etc/network/ -p wa -k system_conf

## Time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -F key=time_change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -F key=time_change

## Audit SSH connections and changes
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /var/log/auth.log -p wa -k ssh_login

## Audit usage of remote tools (e.g., SSH, netcat)
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/nc -k nc_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/nc -k nc_process

## Audit privileged access
-a always,exit -F arch=b64 -S setuid -S setgid -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -S setgid -k privilege_escalation
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/sudoers.d/ -p wa -k sudoers_changes
-w /bin/sudo -p x -k sudo_command

## Monitor credential changes
#-w /root/.ssh/ -p wa -k ssh_keys
#-w /home/*/.ssh/ -p wa -k ssh_keys

## Audit use of remote network services
-a always,exit -F arch=b64 -S socket -F success=1 -k socket_connect
-a always,exit -F arch=b32 -S socket -F success=1 -k socket_connect

# Log package installation and removal via dpkg
-w /usr/bin/dpkg -p x
-w /usr/sbin/apt-get -p x
-w /usr/bin/apt -p x
</syntaxhighlight>This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131, it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks
[[index.php?title=Category:Security]]
[[index.php?title=Category:Hardening]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2025-12-16T15:56:50Z

Blackcat568: /* Security Hardening for Debian Users: Protecting Against Targeted Attacks */

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.

* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

===== Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build). =====
Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

# 1. Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.
# If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to type long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>
# Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.
# Avoid using the superuser account or sudo without a clear necessity — and never execute arbitrary scripts with sudo. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
## Always read a script fully before running it (less script.sh, cat script.sh).
## Never paste commands from untrusted or unverified sources into the terminal.
## Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
## Follow the principle of least privilege — create separate user accounts and limit access rights where possible Important: Improper or careless use of sudo and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.
# Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. You may also consider switching to SELinux. If you have difficulty configuring AppArmor or SELinux, seek help from specialists or use AI-based tools. My SELinux configuration is attached below (I use SELinux on Debian 12 — it works reliably).
# Use advanced network filtering settings: iptables or nftables, or a commercial firewall. (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#nftables config:|nftables config]]
# Configure kernel parameters for maximum security (sysctl hardening). (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#sysctl config:|sysctl config]])
# Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event). (sample [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#auditd rules config:|auditd rules config]]
# Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.
# If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.
# Follow the principle of Attack Surface Reduction (or Occam's_razor) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
## If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
## If you are certain you will never use it, remove it completely from the system.
## This practice reduces potential attack vectors and strengthens overall system security.
## Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications. Always create a full system backup before making any significant configuration changes or modifications.
# Perform regular antivirus and anti-rootkit scans of the system. In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.
# Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:
<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

'''Related Aspects of Internet Security'''

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

1. Store passwords in a reliable password manager.

'''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:

* relying on human memory, with the risk of forgetting or confusing credentials;
* storing passwords on paper media, which can be damaged, lost, or stolen;
* saving passwords in web browsers in unencrypted form;
* keeping passwords in plain text files on the desktop or in other directories without encryption;
* and similar approaches.

Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.

A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.

Regularly create up-to-date backups of the ''encrypted'' password database.

Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.

Additional Practical Recommendations

A password manager (for example, KeePassXC) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.

In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.

It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).

2. Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [[wikipedia:Authenticator_app|Authenticator_app]]), or a hardware security key such as a [[wikipedia:YubiKey|YubiKey]].

This is a critical cybersecurity measure — neglecting it can completely undermine all your efforts in configuring a secure Linux system.

The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:

* YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
* It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
* Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number. For now, it is one of the most reliable hardware-based options for two-factor authentication.

3. Using VPN to improve privacy and security

''If you are a private user'', you can also configure a system-wide VPN (for example, ProtonVPN) so that all device traffic is routed through it — not only browser traffic or traffic from specific applications.

Enable the “killswitch” mode and disable it only when necessary, re-enabling it immediately afterwards.

It is also recommended to periodically change VPN servers, doing so at different and unpredictable intervals.

Using a VPN increases your privacy: all of your traffic will be encrypted from observers on your local network and from your internet service provider. This makes it more difficult for an attacker to apply certain social-engineering methods based on traffic analysis, and it also helps protect your privacy in the event that your provider’s infrastructure is compromised.

''If you own a server'' and want access to it to be available only to trusted private or legal entities, while also increasing its protection against unauthorized access, you can configure the server so that SSH and other internal services are accessible exclusively through OpenVPN using TLS authentication (tls-auth / tls-crypt) and unique client certificates instead of passwords.

4. Actively study and apply artificial intelligence to improve security configurations in Debian and other Linux distributions, as well as to address related cybersecurity tasks. A lack of knowledge often becomes the weakest link; AI can provide accurate, structured recommendations interactively and help automate repetitive or complex operations.

5. If privacy is a priority, consider reducing reliance on the Google ecosystem and switching to more privacy-focused alternatives (for example, proton.me and similar services). Google provides very strong security, but its services collect extensive telemetry for analysis. While this data is encrypted and not accessible to attackers, it may still be undesirable for users who value strict privacy.

''Always verify AI-generated recommendations before applying them in production environments. Test any changes in an isolated system, review generated commands or configurations, and ensure that suggestions align with your threat model and security architecture.''

''In practice, users who effectively leverage AI tools are significantly better prepared, and the adoption of such technologies makes malicious activity considerably more difficult for attackers.''

'''''Note:''' Artificial intelligence tools are mentioned here as optional technical aids, not as an endorsement of any specific service or vendor.''

6. It is also important to consider the possibility of hardware-level attacks.

Although such attacks are significantly less common and typically require more resources than software-based attacks, they remain a potential threat. In certain scenarios, an adversary may exploit vulnerabilities in device firmware or conduct a combined attack targeting both software and hardware layers. Examples include remote injection of malicious code into the firmware of a motherboard, router, optical modem, or other hardware components.

If, after a thorough software-level audit, a security issue remains unresolved, it is advisable <nowiki>'''</nowiki>to perform a hardware-level assessment<nowiki>'''</nowiki> as well, including verification of device firmware integrity and configuration.

<blockquote>'''And most importantly — give up the illusion of complete security. We live in conditions of a severe information war, and everyone must make efforts so that malicious actors cannot freely spy on desktops and servers.'''</blockquote>

'''Examples of Deep Custom Security Configurations'''

Below are examples of strong, individualized configurations for '''SELinux''', '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

====== SELinux config: ======
<syntaxhighlight lang="terminfo">
root@user:/home/user# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
root@user:/home/user# sestatus -v
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

Process contexts:
Current context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Init context: system_u:system_r:init_t:s0
/sbin/agetty system_u:system_r:getty_t:s0

File contexts:
Controlling terminal: unconfined_u:object_r:user_devpts_t:s0
/etc/passwd system_u:object_r:etc_t:s0
/etc/shadow system_u:object_r:unlabeled_t:s0
/bin/bash system_u:object_r:shell_exec_t:s0
/bin/login system_u:object_r:login_exec_t:s0
/bin/sh system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0
/sbin/agetty system_u:object_r:getty_exec_t:s0
/sbin/init system_u:object_r:bin_t:s0 -> system_u:object_r:init_exec_t:s0
/lib/ld-linux.so.2 system_u:object_r:lib_t:s0 -> system_u:object_r:ld_so_t:s0
</syntaxhighlight>

====== nftables config: ======
<syntaxhighlight lang="bash">
#!/usr/sbin/nft -f

flush ruleset

table inet filter {

# = Main chain policy =
chain input {
type filter hook input priority 0;
policy drop;

# = Common rule set =
# 🌀 Allow loopback interface (internal system processes)
iif "lo" accept

# == 🔁 Allow established and related connections ==
ct state established,related accept

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# == 🔒 Limit the rate of NEW connections per source IP (basic anti-DDoS protection) ==
# If you experience issues with slow or failed page loads in your browser,
# try increasing the limit, for example:
# ip saddr 0.0.0.0/0 ct state new limit rate 50/second burst 100 packets accept
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == 🚫 Blocking SSDP and mDNS (local broadcast discovery protocols) ==
ip daddr 239.255.255.250 udp dport 1900 drop # ❌ SSDP (UPnP/device discovery)
ip daddr 224.0.0.251 udp dport 5353 drop # ❌ mDNS (Bonjour, Avahi)

# == 🛑 Blocking NetBIOS and LLMNR (Windows/systemd internal LAN protocols) ==
udp dport 137 drop # ❌ NetBIOS Name Service (Windows network names)
udp dport 138 drop # ❌ NetBIOS Datagram Service (LAN name discovery)
udp dport 5355 drop # ❌ LLMNR (Link-Local Multicast Name Resolution)

# = Set of blocked IP addresses and ranges =

# == 🧱 Blocking known botnets and proxy networks ==
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} log prefix "🔥 BAN: known bots " flags all
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} drop

# == 🚫 Blocking strange TCP flags (XMAS, NULL scans and others) ==
tcp flags & (fin|syn|rst|psh|ack|urg) == 0 drop # NULL scan
tcp flags & (fin|psh|urg) == (fin|psh|urg) drop # XMAS scan
tcp flags & (fin|syn) == (fin|syn) drop # SYN-ACK scan
tcp flags & (syn|rst|fin) == (syn|rst|fin) drop # Xmas scan
tcp flags & (syn|fin|rst|psh|ack) == (syn|rst|fin|ack) drop # Xmas scan

# == 🚫 Blocking fragmented packets — commonly used in filter evasion ==
ip frag-off & 0x1fff != 0 drop

# == 🔒 Blocking spoofed IP packets ==
ip saddr 127.0.0.0/8 drop # localhost
ip saddr 10.0.0.0/8 drop # private network
ip saddr 172.16.0.0/12 drop # private network
ip saddr 192.168.0.0/16 drop # private network
ip saddr 169.254.0.0/16 drop # APIPA
ip saddr 0.0.0.0/8 drop # invalid address
ip saddr 224.0.0.0/4 drop # multicast
ip saddr 240.0.0.0/5 drop # reserved
}

# = Main chain policy =
chain forward {
type filter hook forward priority 0;
policy accept;

# = Blocking various types of attacks =
# Required in chain forward only if Docker or Oracle VirtualBox is present.
# If needed — uncomment.

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
# ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
# ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
# ip protocol icmp icmp type echo-request limit rate 1/second accept
# ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
# ip protocol icmp icmp type echo-request drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports required for application operation ==
tcp dport {
53, # DNS — needed for domain name resolution
80, # HTTP — web traffic, updates and resource loading
443, # HTTPS — secure web traffic, VPN, browser
12043, # Custom 3D Application — specific client port
13000-13050 # Custom 3D Application — dynamic client port range
} accept

# == Allow UDP ports required for application operation ==
udp dport {
53, # DNS — needed for domain name resolution
443, # HTTPS via QUIC/HTTP3, browser protocols
3478, # STUN/TURN — WebRTC and video calls
3479-3481 # STUN/TURN — WebRTC and video calls
} accept

# = Blocking dangerous and unnecessary TCP/UDP ports and ranges =

# These blocklists are intended for a DESKTOP / workstation.
# They block remote access, outdated services, proxies, DBs, IoT, and ports
# often used by malware, scanners, and C2 infrastructures.
#
# ⚠ If you use the system as a SERVER, enable IP forwarding,
# or run services with internal routing
# (Docker NAT/bridge, VirtualBox host-only/bridged, VPN clients),
# carefully review the blocked ports/ranges in the forward chain —
# these services may need extra ports.
# Adjust or comment out required items if necessary.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high risk) ===
22, # SSH — common brute-force target
23, # Telnet — outdated, no encryption
3389, # RDP — Windows remote desktop
5900, # VNC — remote access, frequent vulnerabilities
# === FTP / SMB / NetBIOS (unsafe file-sharing protocols) ===
21, # FTP — insecure protocol
137, # NetBIOS Name Service
138, # NetBIOS Datagram
139, # NetBIOS Session
445, # SMB/CIFS — common exploit target
# === Databases (NEVER expose to the Internet) ===
3306, # MySQL/MariaDB
1433, # MS SQL Server
1434, # MS SQL Browser
# === HTTP-alt/Proxy/Elasticsearch (exploited frequently) ===
8080, # HTTP proxy / web interfaces — often exposed accidentally
9200, # Elasticsearch API — full remote data access
# === UPnP/IoT (insecure by design) ===
1900, # SSDP / UPnP
# === Common for malware (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell
5555, # Android ADB / IoT botnets
9001, # Tor transport (used by malware)
1234, # Netcat / reverse connections
1337, # Common C2 port used by malware
# === ⚠️ Scanner ports and potentially vulnerable services ===
1080, # SOCKS proxy — used to bypass filtering
3128, # Squid proxy — may be abused as open proxy
8000, # Alternative HTTP ports, dev servers
8888, # Web interfaces, proxies, dev tools
10000 # Webmin — remote admin panel, frequent attacks
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; abused by attackers
162 # SNMP Trap — also potentially vulnerable
} drop

# Attention! Blocking wide port ranges — be careful!
# Do not break system or application functionality!

# == TCP port ranges not used by a workstation during transit routing ==
# Blocked to prevent unwanted forwarding, hidden tunnels,
# NAT evasion, parasitic flows, and potential forward-path attacks.

tcp dport {
1024-2047, # System/legacy services; rarely needed in forward
2048-4095, # Proprietary daemons; NFS (2049) — check if used
4096-8191, # Old VPNs, some games, P2P; rarely needed on desktop
8192-12287, # Alternative HTTP/proxy, multimedia; test as needed
12288-16383, # Media/VoIP (TCP fallback); may break calls
16384-24575, # RTP/WebRTC (TCP fallback); block unless AV needed
24576-32767, # Dynamic ranges for games/VPN; may cause issues
32768-49151, # Registered/ephemeral; risky — may break NAT, Docker, VM
49152-65535 # High ephemeral; widely used by modern apps
} drop

# == 🚫 Blocking UDP ports — high and dynamic ranges ==
udp dport {
1024-9999, # low/mid ephemeral ports; used by trojans, P2P, games, VPN
10000-65535 # high ephemeral; used by dynamic apps, VPN, Docker
} drop

# = 🕷️ Suspicious IPs — large ranges often used by botnets, spam nets, and scanners =
ip saddr {
185.0.0.0/8, # abused hosting and proxy networks
37.0.0.0/8, # cheap VPS, frequent scanning sources
88.0.0.0/8, # common brute-force and scanner range
77.0.0.0/8, # TOR/proxy nodes
91.0.0.0/8 # botnets and “grey-zone” hosting
} drop
}

chain output {
# = Main chain policy =
type filter hook output priority 0;
policy accept;

# = Blocking various types of attacks =

# == 🔒 Limiting new connections from a single IP (anti-DDoS) ==
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# = ICMP protocol restrictions =

# == 🛡️ Ping limitation ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == Critically important ICMP for network ==
ip protocol icmp icmp type { destination-unreachable, time-exceeded, parameter-problem } accept

# == Important ICMPv6 for IPv6 ==
ip6 nexthdr icmpv6 icmpv6 type { 1, 2, 3, 4 } accept
ip6 nexthdr icmpv6 icmpv6 type { 135, 136 } accept # NS/NA
ip6 nexthdr icmpv6 icmpv6 type { 133, 134 } accept # RS/RA

# == Drop all other ICMP and ICMPv6 ==
ip protocol icmp drop # drop all other ICMP
ip6 nexthdr icmpv6 drop # drop all other ICMPv6

# = SCTP protocol blocking =
# 99.9% of desktop systems do not use SCTP at all
meta l4proto sctp drop

# = DCCP — Datagram Congestion Control Protocol blocking =
# Not used by any mainstream desktop applications
meta l4proto dccp drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports and ranges required for application functionality ==
tcp dport {
53, # DNS client. Required for Internet to work: domain name resolution (UDP/TCP).
80, # HTTP traffic to unencrypted websites; apps may use it for API/redirects.
443, # HTTPS. Main port for all encrypted web traffic — browsers, API, VPN, updates.
3306, # MySQL client. Needed if you connect to MySQL.
3478, # STUN/TURN WebRTC. Needed for audio/video/Discord.
3000, # Node.js dev servers. Needed for development.
3690, # SVN. If you work with an old repository.
4443, # Alternative HTTPS (some APIs). Also used by some VPN/clients.
12043, # Required for Custom 3D Application.
13000-13050 # Required for Custom 3D Application.
} accept

# == Allow UDP ports and ranges required for applications ==
udp dport {
443, # Required for fast and stable operation of modern websites
# (Google, YouTube, ChatGPT, Cloudflare)
13000-13050 # Required for Custom 3D Application.
} accept

# = Blocking potentially dangerous / unnecessary TCP/UDP ports =

# These blocks are intended for a DESKTOP / workstation.
# ⚠ If you use the system as a SERVER —
# adjust or comment out the required ports/ranges as needed.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high-risk) ===
22, # SSH — target of brute-force attacks.
23, # Telnet — outdated, unencrypted.
3389, # RDP — Windows remote access.
5900, # VNC — remote access, often vulnerable.
# === FTP / SMB / NetBIOS (dangerous file-sharing services) ===
21, # FTP — insecure protocol.
137, # NetBIOS Name Service.
138, # NetBIOS Datagram.
139, # NetBIOS Session.
445, # SMB/CIFS — frequent exploitation target.
# === Databases (NEVER open to the Internet) ===
3306, # MySQL/MariaDB.
1433, # MS SQL Server.
1434, # MS SQL Browser.
# === HTTP-alt/Proxy/Elasticsearch (dangerous, often attacked) ===
8080, # HTTP proxy / web interfaces — often exposed test interfaces.
9200, # Elasticsearch API — full remote access to data.
# === UPnP/IoT (vulnerable by design) ===
1900, # SSDP / UPnP.
# === Common malware ports (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell.
5555, # Android ADB / IoT botnets.
9001, # Tor transport (used by malware).
1234, # Netcat / reverse connections.
1337, # Common C2 malware port.
# === ⚠️ Ports of scanners and potentially vulnerable services ===
1080, # SOCKS proxy — often abused for bypassing filters.
3128, # Squid HTTP proxy — can be used as open proxy.
8000, # Alternative HTTP ports, web services — potentially vulnerable.
8888, # Alternative web interfaces — test and proxy ports.
10000 # Webmin — web admin panel, target of attacks.
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; can be abused by attackers.
162 # SNMP Trap — same, potential vulnerability.
} drop

# Warning! ⚠️ Be careful blocking wide port ranges! ⚠️
# Do not break system or application functionality!
# If you need a range — uncomment.
# If you don’t — comment out.

# == Blocking “dangerous” and desktop-unnecessary TCP port ranges ==
tcp dport {
1-1023, # 🛑 Privileged ports.
1024-2047, # r-commands (rlogin, rsh, rexec), old RPC, NFS, legacy daemons.
2048-3071, # Rare proprietary protocols and middleware.
3072-4999, # Mostly ports of legacy, server, corporate apps;
# rarely needed on workstations.
5000-5999, # Alternative services, old P2P/admin ports, rarely used on desktops.
7000-7999, # Alternative/test ports, often used by trojans.
9000-9999, # Web services, proxies, possible backdoor ports.
10000-19998, # Dynamic/high service ports; may be required by some apps like Custom 3D Application,
# but not needed by most desktop services.
19999-32767 # Old ephemeral port range; used by P2P, games, some VPNs,
# but system services rarely use them.
} drop

# == Blocking “dangerous” and desktop-unnecessary UDP port ranges ==
udp dport {
1024-2047, # Old UNIX services, RPC, NFS, r-commands, legacy daemons.
# Usually safe to block.
2048-4095, # Rarely used standard ports, proprietary services.
# Usually safe to block.
4096-8191, # VPN, games, P2P, WebRTC, VoIP of some clients.
# Can block, but cautiously: may affect VPN/apps.
8192-12287, # QUIC/HTTP3, proxies, multimedia protocols.
# Might cause side effects; better test first.
12288-16383, # Old RTP/VoIP ranges and media streams.
# Can block, but might break video calls.
16384-24575, # Main RTP range (audio/video), WebRTC, VoIP.
# ❗ Do not block if you need video calls/WebRTC/VPN.
24576-32767 # Dynamic ports for VPN, P2P, games, streaming data.
# ❗ May break VPN or some apps.
} drop

# == 🕷️ Blocking suspicious IPs —
# large ranges often used by botnets, spam networks, and scanners ==
ip saddr {
185.0.0.0/8, # Abused hosting and proxy networks.
37.0.0.0/8, # Cheap VPS, scanning sources.
88.0.0.0/8, # Frequent brute-force and scanners.
77.0.0.0/8, # Massive TOR/proxy nodes.
91.0.0.0/8 # Botnets and “grey” hosting.
} drop
}
}

</syntaxhighlight>

====== sysctl config: ======
kernel parameters configuration

/etc/sysctl.d/99-protect.conf<syntaxhighlight lang="bash">
# 1 Ignore ICMP on interfaces
net.ipv4.icmp_echo_ignore_all = 1

# 2 Do not respond to ICMP broadcast (against Smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 3 Enable SYN backlog reduction
net.ipv4.tcp_syncookies = 1

# 4 Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 5 Log packets with incorrect routing
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# 6 Disable ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# 7 Disable packet forwarding
net.ipv4.ip_forward = 0

# 8 Disable IPv6 support
net.ipv4.conf.all.disable_ipv6 = 1
net.ipv4.conf.default.disable_ipv6 = 1

# 9 Prevent sending TCP segments with null windows
net.ipv4.tcp_rfc1337 = 1

# 10 Disable ARP filtering for automatic routing
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1

# 11 Limit the maximum size of the incoming TCP window
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# 12 Drop packets with incorrect checksums
net.ipv4.conf.all.drop_unicast_in_l2_multicast = 1
net.ipv4.conf.default.drop_unicast_in_l2_multicast = 1

# 13 Disable IPv6 forwarding
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# 14 Limit the maximum number of SYN packet retries
net.ipv4.tcp_synack_retries = 2

# 15 Increase routing cache lifetime
net.ipv4.route.max_size = 32768
</syntaxhighlight>

====== auditd rules config: ======
/etc/audit/rules.d/audit.rules

<syntaxhighlight lang="bash">
## Flush rules
-D

## Buffers
-b 8192
--backlog_wait_time 60000
-f 1

## Network audit
-a always,exit -F arch=b64 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b64 -S accept4 -F success=1 -k network_accept
-a always,exit -F arch=b32 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b32 -S accept4 -F success=1 -k network_accept

## Logging execve commands
-a always,exit -F arch=b64 -S execve -F key=exec_log

## Audit logins and sessions
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session

## sudo / su
-w /etc/sudoers -p wa -k sudo
-w /etc/sudoers.d/ -p wa -k sudo
-w /bin/su -p x -k su_cmd

## Account and configuration changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/hosts -p wa -k system_conf
-w /etc/hostname -p wa -k system_conf
-w /etc/resolv.conf -p wa -k system_conf
-w /etc/issue -p wa -k system_conf
-w /etc/network/ -p wa -k system_conf

## Time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -F key=time_change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -F key=time_change

## Audit SSH connections and changes
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /var/log/auth.log -p wa -k ssh_login

## Audit usage of remote tools (e.g., SSH, netcat)
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/nc -k nc_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/nc -k nc_process

## Audit privileged access
-a always,exit -F arch=b64 -S setuid -S setgid -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -S setgid -k privilege_escalation
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/sudoers.d/ -p wa -k sudoers_changes
-w /bin/sudo -p x -k sudo_command

## Monitor credential changes
#-w /root/.ssh/ -p wa -k ssh_keys
#-w /home/*/.ssh/ -p wa -k ssh_keys

## Audit use of remote network services
-a always,exit -F arch=b64 -S socket -F success=1 -k socket_connect
-a always,exit -F arch=b32 -S socket -F success=1 -k socket_connect

# Log package installation and removal via dpkg
-w /usr/bin/dpkg -p x
-w /usr/sbin/apt-get -p x
-w /usr/bin/apt -p x
</syntaxhighlight>This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131, it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks
[[index.php?title=Category:Security]]
[[index.php?title=Category:Hardening]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2025-12-16T15:55:01Z

Blackcat568: /* Security Hardening for Debian Users: Protecting Against Targeted Attacks */

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.

* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

===== Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build). =====
Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

# 1. Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.
# If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to use long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>
# Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.
# Avoid using the superuser account or sudo without a clear necessity — and never execute arbitrary scripts with sudo. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
## Always read a script fully before running it (less script.sh, cat script.sh).
## Never paste commands from untrusted or unverified sources into the terminal.
## Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
## Follow the principle of least privilege — create separate user accounts and limit access rights where possible Important: Improper or careless use of sudo and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.
# Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. You may also consider switching to SELinux. If you have difficulty configuring AppArmor or SELinux, seek help from specialists or use AI-based tools. My SELinux configuration is attached below (I use SELinux on Debian 12 — it works reliably).
# Use advanced network filtering settings: iptables or nftables, or a commercial firewall. (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#nftables config:|nftables config]]
# Configure kernel parameters for maximum security (sysctl hardening). (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#sysctl config:|sysctl config]])
# Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, Suricata, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event). (sample [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#auditd rules config:|auditd rules config]]
# Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.
# If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.
# Follow the principle of Attack Surface Reduction (or Occam's_razor) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
## If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
## If you are certain you will never use it, remove it completely from the system.
## This practice reduces potential attack vectors and strengthens overall system security.
## Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications. Always create a full system backup before making any significant configuration changes or modifications.
# Perform regular antivirus and anti-rootkit scans of the system. In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.
# Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:
<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

'''Related Aspects of Internet Security'''

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

1. Store passwords in a reliable password manager.

'''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:

* relying on human memory, with the risk of forgetting or confusing credentials;
* storing passwords on paper media, which can be damaged, lost, or stolen;
* saving passwords in web browsers in unencrypted form;
* keeping passwords in plain text files on the desktop or in other directories without encryption;
* and similar approaches.

Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.

A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.

Regularly create up-to-date backups of the ''encrypted'' password database.

Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.

Additional Practical Recommendations

A password manager (for example, KeePassXC) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.

In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.

It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).

2. Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [[wikipedia:Authenticator_app|Authenticator_app]]), or a hardware security key such as a [[wikipedia:YubiKey|YubiKey]].

This is a critical cybersecurity measure — neglecting it can completely undermine all your efforts in configuring a secure Linux system.

The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:

* YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
* It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
* Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number. For now, it is one of the most reliable hardware-based options for two-factor authentication.

3. Using VPN to improve privacy and security

''If you are a private user'', you can also configure a system-wide VPN (for example, ProtonVPN) so that all device traffic is routed through it — not only browser traffic or traffic from specific applications.

Enable the “killswitch” mode and disable it only when necessary, re-enabling it immediately afterwards.

It is also recommended to periodically change VPN servers, doing so at different and unpredictable intervals.

Using a VPN increases your privacy: all of your traffic will be encrypted from observers on your local network and from your internet service provider. This makes it more difficult for an attacker to apply certain social-engineering methods based on traffic analysis, and it also helps protect your privacy in the event that your provider’s infrastructure is compromised.

''If you own a server'' and want access to it to be available only to trusted private or legal entities, while also increasing its protection against unauthorized access, you can configure the server so that SSH and other internal services are accessible exclusively through OpenVPN using TLS authentication (tls-auth / tls-crypt) and unique client certificates instead of passwords.

4. Actively study and apply artificial intelligence to improve security configurations in Debian and other Linux distributions, as well as to address related cybersecurity tasks. A lack of knowledge often becomes the weakest link; AI can provide accurate, structured recommendations interactively and help automate repetitive or complex operations.

5. If privacy is a priority, consider reducing reliance on the Google ecosystem and switching to more privacy-focused alternatives (for example, proton.me and similar services). Google provides very strong security, but its services collect extensive telemetry for analysis. While this data is encrypted and not accessible to attackers, it may still be undesirable for users who value strict privacy.

''Always verify AI-generated recommendations before applying them in production environments. Test any changes in an isolated system, review generated commands or configurations, and ensure that suggestions align with your threat model and security architecture.''

''In practice, users who effectively leverage AI tools are significantly better prepared, and the adoption of such technologies makes malicious activity considerably more difficult for attackers.''

'''''Note:''' Artificial intelligence tools are mentioned here as optional technical aids, not as an endorsement of any specific service or vendor.''

6. It is also important to consider the possibility of hardware-level attacks.

Although such attacks are significantly less common and typically require more resources than software-based attacks, they remain a potential threat. In certain scenarios, an adversary may exploit vulnerabilities in device firmware or conduct a combined attack targeting both software and hardware layers. Examples include remote injection of malicious code into the firmware of a motherboard, router, optical modem, or other hardware components.

If, after a thorough software-level audit, a security issue remains unresolved, it is advisable <nowiki>'''</nowiki>to perform a hardware-level assessment<nowiki>'''</nowiki> as well, including verification of device firmware integrity and configuration.

<blockquote>'''And most importantly — give up the illusion of complete security. We live in conditions of a severe information war, and everyone must make efforts so that malicious actors cannot freely spy on desktops and servers.'''</blockquote>

'''Examples of Deep Custom Security Configurations'''

Below are examples of strong, individualized configurations for '''SELinux''', '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

====== SELinux config: ======
<syntaxhighlight lang="terminfo">
root@user:/home/user# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
root@user:/home/user# sestatus -v
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

Process contexts:
Current context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Init context: system_u:system_r:init_t:s0
/sbin/agetty system_u:system_r:getty_t:s0

File contexts:
Controlling terminal: unconfined_u:object_r:user_devpts_t:s0
/etc/passwd system_u:object_r:etc_t:s0
/etc/shadow system_u:object_r:unlabeled_t:s0
/bin/bash system_u:object_r:shell_exec_t:s0
/bin/login system_u:object_r:login_exec_t:s0
/bin/sh system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0
/sbin/agetty system_u:object_r:getty_exec_t:s0
/sbin/init system_u:object_r:bin_t:s0 -> system_u:object_r:init_exec_t:s0
/lib/ld-linux.so.2 system_u:object_r:lib_t:s0 -> system_u:object_r:ld_so_t:s0
</syntaxhighlight>

====== nftables config: ======
<syntaxhighlight lang="bash">
#!/usr/sbin/nft -f

flush ruleset

table inet filter {

# = Main chain policy =
chain input {
type filter hook input priority 0;
policy drop;

# = Common rule set =
# 🌀 Allow loopback interface (internal system processes)
iif "lo" accept

# == 🔁 Allow established and related connections ==
ct state established,related accept

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# == 🔒 Limit the rate of NEW connections per source IP (basic anti-DDoS protection) ==
# If you experience issues with slow or failed page loads in your browser,
# try increasing the limit, for example:
# ip saddr 0.0.0.0/0 ct state new limit rate 50/second burst 100 packets accept
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == 🚫 Blocking SSDP and mDNS (local broadcast discovery protocols) ==
ip daddr 239.255.255.250 udp dport 1900 drop # ❌ SSDP (UPnP/device discovery)
ip daddr 224.0.0.251 udp dport 5353 drop # ❌ mDNS (Bonjour, Avahi)

# == 🛑 Blocking NetBIOS and LLMNR (Windows/systemd internal LAN protocols) ==
udp dport 137 drop # ❌ NetBIOS Name Service (Windows network names)
udp dport 138 drop # ❌ NetBIOS Datagram Service (LAN name discovery)
udp dport 5355 drop # ❌ LLMNR (Link-Local Multicast Name Resolution)

# = Set of blocked IP addresses and ranges =

# == 🧱 Blocking known botnets and proxy networks ==
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} log prefix "🔥 BAN: known bots " flags all
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} drop

# == 🚫 Blocking strange TCP flags (XMAS, NULL scans and others) ==
tcp flags & (fin|syn|rst|psh|ack|urg) == 0 drop # NULL scan
tcp flags & (fin|psh|urg) == (fin|psh|urg) drop # XMAS scan
tcp flags & (fin|syn) == (fin|syn) drop # SYN-ACK scan
tcp flags & (syn|rst|fin) == (syn|rst|fin) drop # Xmas scan
tcp flags & (syn|fin|rst|psh|ack) == (syn|rst|fin|ack) drop # Xmas scan

# == 🚫 Blocking fragmented packets — commonly used in filter evasion ==
ip frag-off & 0x1fff != 0 drop

# == 🔒 Blocking spoofed IP packets ==
ip saddr 127.0.0.0/8 drop # localhost
ip saddr 10.0.0.0/8 drop # private network
ip saddr 172.16.0.0/12 drop # private network
ip saddr 192.168.0.0/16 drop # private network
ip saddr 169.254.0.0/16 drop # APIPA
ip saddr 0.0.0.0/8 drop # invalid address
ip saddr 224.0.0.0/4 drop # multicast
ip saddr 240.0.0.0/5 drop # reserved
}

# = Main chain policy =
chain forward {
type filter hook forward priority 0;
policy accept;

# = Blocking various types of attacks =
# Required in chain forward only if Docker or Oracle VirtualBox is present.
# If needed — uncomment.

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
# ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
# ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
# ip protocol icmp icmp type echo-request limit rate 1/second accept
# ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
# ip protocol icmp icmp type echo-request drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports required for application operation ==
tcp dport {
53, # DNS — needed for domain name resolution
80, # HTTP — web traffic, updates and resource loading
443, # HTTPS — secure web traffic, VPN, browser
12043, # Custom 3D Application — specific client port
13000-13050 # Custom 3D Application — dynamic client port range
} accept

# == Allow UDP ports required for application operation ==
udp dport {
53, # DNS — needed for domain name resolution
443, # HTTPS via QUIC/HTTP3, browser protocols
3478, # STUN/TURN — WebRTC and video calls
3479-3481 # STUN/TURN — WebRTC and video calls
} accept

# = Blocking dangerous and unnecessary TCP/UDP ports and ranges =

# These blocklists are intended for a DESKTOP / workstation.
# They block remote access, outdated services, proxies, DBs, IoT, and ports
# often used by malware, scanners, and C2 infrastructures.
#
# ⚠ If you use the system as a SERVER, enable IP forwarding,
# or run services with internal routing
# (Docker NAT/bridge, VirtualBox host-only/bridged, VPN clients),
# carefully review the blocked ports/ranges in the forward chain —
# these services may need extra ports.
# Adjust or comment out required items if necessary.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high risk) ===
22, # SSH — common brute-force target
23, # Telnet — outdated, no encryption
3389, # RDP — Windows remote desktop
5900, # VNC — remote access, frequent vulnerabilities
# === FTP / SMB / NetBIOS (unsafe file-sharing protocols) ===
21, # FTP — insecure protocol
137, # NetBIOS Name Service
138, # NetBIOS Datagram
139, # NetBIOS Session
445, # SMB/CIFS — common exploit target
# === Databases (NEVER expose to the Internet) ===
3306, # MySQL/MariaDB
1433, # MS SQL Server
1434, # MS SQL Browser
# === HTTP-alt/Proxy/Elasticsearch (exploited frequently) ===
8080, # HTTP proxy / web interfaces — often exposed accidentally
9200, # Elasticsearch API — full remote data access
# === UPnP/IoT (insecure by design) ===
1900, # SSDP / UPnP
# === Common for malware (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell
5555, # Android ADB / IoT botnets
9001, # Tor transport (used by malware)
1234, # Netcat / reverse connections
1337, # Common C2 port used by malware
# === ⚠️ Scanner ports and potentially vulnerable services ===
1080, # SOCKS proxy — used to bypass filtering
3128, # Squid proxy — may be abused as open proxy
8000, # Alternative HTTP ports, dev servers
8888, # Web interfaces, proxies, dev tools
10000 # Webmin — remote admin panel, frequent attacks
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; abused by attackers
162 # SNMP Trap — also potentially vulnerable
} drop

# Attention! Blocking wide port ranges — be careful!
# Do not break system or application functionality!

# == TCP port ranges not used by a workstation during transit routing ==
# Blocked to prevent unwanted forwarding, hidden tunnels,
# NAT evasion, parasitic flows, and potential forward-path attacks.

tcp dport {
1024-2047, # System/legacy services; rarely needed in forward
2048-4095, # Proprietary daemons; NFS (2049) — check if used
4096-8191, # Old VPNs, some games, P2P; rarely needed on desktop
8192-12287, # Alternative HTTP/proxy, multimedia; test as needed
12288-16383, # Media/VoIP (TCP fallback); may break calls
16384-24575, # RTP/WebRTC (TCP fallback); block unless AV needed
24576-32767, # Dynamic ranges for games/VPN; may cause issues
32768-49151, # Registered/ephemeral; risky — may break NAT, Docker, VM
49152-65535 # High ephemeral; widely used by modern apps
} drop

# == 🚫 Blocking UDP ports — high and dynamic ranges ==
udp dport {
1024-9999, # low/mid ephemeral ports; used by trojans, P2P, games, VPN
10000-65535 # high ephemeral; used by dynamic apps, VPN, Docker
} drop

# = 🕷️ Suspicious IPs — large ranges often used by botnets, spam nets, and scanners =
ip saddr {
185.0.0.0/8, # abused hosting and proxy networks
37.0.0.0/8, # cheap VPS, frequent scanning sources
88.0.0.0/8, # common brute-force and scanner range
77.0.0.0/8, # TOR/proxy nodes
91.0.0.0/8 # botnets and “grey-zone” hosting
} drop
}

chain output {
# = Main chain policy =
type filter hook output priority 0;
policy accept;

# = Blocking various types of attacks =

# == 🔒 Limiting new connections from a single IP (anti-DDoS) ==
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# = ICMP protocol restrictions =

# == 🛡️ Ping limitation ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == Critically important ICMP for network ==
ip protocol icmp icmp type { destination-unreachable, time-exceeded, parameter-problem } accept

# == Important ICMPv6 for IPv6 ==
ip6 nexthdr icmpv6 icmpv6 type { 1, 2, 3, 4 } accept
ip6 nexthdr icmpv6 icmpv6 type { 135, 136 } accept # NS/NA
ip6 nexthdr icmpv6 icmpv6 type { 133, 134 } accept # RS/RA

# == Drop all other ICMP and ICMPv6 ==
ip protocol icmp drop # drop all other ICMP
ip6 nexthdr icmpv6 drop # drop all other ICMPv6

# = SCTP protocol blocking =
# 99.9% of desktop systems do not use SCTP at all
meta l4proto sctp drop

# = DCCP — Datagram Congestion Control Protocol blocking =
# Not used by any mainstream desktop applications
meta l4proto dccp drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports and ranges required for application functionality ==
tcp dport {
53, # DNS client. Required for Internet to work: domain name resolution (UDP/TCP).
80, # HTTP traffic to unencrypted websites; apps may use it for API/redirects.
443, # HTTPS. Main port for all encrypted web traffic — browsers, API, VPN, updates.
3306, # MySQL client. Needed if you connect to MySQL.
3478, # STUN/TURN WebRTC. Needed for audio/video/Discord.
3000, # Node.js dev servers. Needed for development.
3690, # SVN. If you work with an old repository.
4443, # Alternative HTTPS (some APIs). Also used by some VPN/clients.
12043, # Required for Custom 3D Application.
13000-13050 # Required for Custom 3D Application.
} accept

# == Allow UDP ports and ranges required for applications ==
udp dport {
443, # Required for fast and stable operation of modern websites
# (Google, YouTube, ChatGPT, Cloudflare)
13000-13050 # Required for Custom 3D Application.
} accept

# = Blocking potentially dangerous / unnecessary TCP/UDP ports =

# These blocks are intended for a DESKTOP / workstation.
# ⚠ If you use the system as a SERVER —
# adjust or comment out the required ports/ranges as needed.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high-risk) ===
22, # SSH — target of brute-force attacks.
23, # Telnet — outdated, unencrypted.
3389, # RDP — Windows remote access.
5900, # VNC — remote access, often vulnerable.
# === FTP / SMB / NetBIOS (dangerous file-sharing services) ===
21, # FTP — insecure protocol.
137, # NetBIOS Name Service.
138, # NetBIOS Datagram.
139, # NetBIOS Session.
445, # SMB/CIFS — frequent exploitation target.
# === Databases (NEVER open to the Internet) ===
3306, # MySQL/MariaDB.
1433, # MS SQL Server.
1434, # MS SQL Browser.
# === HTTP-alt/Proxy/Elasticsearch (dangerous, often attacked) ===
8080, # HTTP proxy / web interfaces — often exposed test interfaces.
9200, # Elasticsearch API — full remote access to data.
# === UPnP/IoT (vulnerable by design) ===
1900, # SSDP / UPnP.
# === Common malware ports (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell.
5555, # Android ADB / IoT botnets.
9001, # Tor transport (used by malware).
1234, # Netcat / reverse connections.
1337, # Common C2 malware port.
# === ⚠️ Ports of scanners and potentially vulnerable services ===
1080, # SOCKS proxy — often abused for bypassing filters.
3128, # Squid HTTP proxy — can be used as open proxy.
8000, # Alternative HTTP ports, web services — potentially vulnerable.
8888, # Alternative web interfaces — test and proxy ports.
10000 # Webmin — web admin panel, target of attacks.
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; can be abused by attackers.
162 # SNMP Trap — same, potential vulnerability.
} drop

# Warning! ⚠️ Be careful blocking wide port ranges! ⚠️
# Do not break system or application functionality!
# If you need a range — uncomment.
# If you don’t — comment out.

# == Blocking “dangerous” and desktop-unnecessary TCP port ranges ==
tcp dport {
1-1023, # 🛑 Privileged ports.
1024-2047, # r-commands (rlogin, rsh, rexec), old RPC, NFS, legacy daemons.
2048-3071, # Rare proprietary protocols and middleware.
3072-4999, # Mostly ports of legacy, server, corporate apps;
# rarely needed on workstations.
5000-5999, # Alternative services, old P2P/admin ports, rarely used on desktops.
7000-7999, # Alternative/test ports, often used by trojans.
9000-9999, # Web services, proxies, possible backdoor ports.
10000-19998, # Dynamic/high service ports; may be required by some apps like Custom 3D Application,
# but not needed by most desktop services.
19999-32767 # Old ephemeral port range; used by P2P, games, some VPNs,
# but system services rarely use them.
} drop

# == Blocking “dangerous” and desktop-unnecessary UDP port ranges ==
udp dport {
1024-2047, # Old UNIX services, RPC, NFS, r-commands, legacy daemons.
# Usually safe to block.
2048-4095, # Rarely used standard ports, proprietary services.
# Usually safe to block.
4096-8191, # VPN, games, P2P, WebRTC, VoIP of some clients.
# Can block, but cautiously: may affect VPN/apps.
8192-12287, # QUIC/HTTP3, proxies, multimedia protocols.
# Might cause side effects; better test first.
12288-16383, # Old RTP/VoIP ranges and media streams.
# Can block, but might break video calls.
16384-24575, # Main RTP range (audio/video), WebRTC, VoIP.
# ❗ Do not block if you need video calls/WebRTC/VPN.
24576-32767 # Dynamic ports for VPN, P2P, games, streaming data.
# ❗ May break VPN or some apps.
} drop

# == 🕷️ Blocking suspicious IPs —
# large ranges often used by botnets, spam networks, and scanners ==
ip saddr {
185.0.0.0/8, # Abused hosting and proxy networks.
37.0.0.0/8, # Cheap VPS, scanning sources.
88.0.0.0/8, # Frequent brute-force and scanners.
77.0.0.0/8, # Massive TOR/proxy nodes.
91.0.0.0/8 # Botnets and “grey” hosting.
} drop
}
}

</syntaxhighlight>

====== sysctl config: ======
kernel parameters configuration

/etc/sysctl.d/99-protect.conf<syntaxhighlight lang="bash">
# 1 Ignore ICMP on interfaces
net.ipv4.icmp_echo_ignore_all = 1

# 2 Do not respond to ICMP broadcast (against Smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 3 Enable SYN backlog reduction
net.ipv4.tcp_syncookies = 1

# 4 Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 5 Log packets with incorrect routing
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# 6 Disable ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# 7 Disable packet forwarding
net.ipv4.ip_forward = 0

# 8 Disable IPv6 support
net.ipv4.conf.all.disable_ipv6 = 1
net.ipv4.conf.default.disable_ipv6 = 1

# 9 Prevent sending TCP segments with null windows
net.ipv4.tcp_rfc1337 = 1

# 10 Disable ARP filtering for automatic routing
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1

# 11 Limit the maximum size of the incoming TCP window
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# 12 Drop packets with incorrect checksums
net.ipv4.conf.all.drop_unicast_in_l2_multicast = 1
net.ipv4.conf.default.drop_unicast_in_l2_multicast = 1

# 13 Disable IPv6 forwarding
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# 14 Limit the maximum number of SYN packet retries
net.ipv4.tcp_synack_retries = 2

# 15 Increase routing cache lifetime
net.ipv4.route.max_size = 32768
</syntaxhighlight>

====== auditd rules config: ======
/etc/audit/rules.d/audit.rules

<syntaxhighlight lang="bash">
## Flush rules
-D

## Buffers
-b 8192
--backlog_wait_time 60000
-f 1

## Network audit
-a always,exit -F arch=b64 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b64 -S accept4 -F success=1 -k network_accept
-a always,exit -F arch=b32 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b32 -S accept4 -F success=1 -k network_accept

## Logging execve commands
-a always,exit -F arch=b64 -S execve -F key=exec_log

## Audit logins and sessions
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session

## sudo / su
-w /etc/sudoers -p wa -k sudo
-w /etc/sudoers.d/ -p wa -k sudo
-w /bin/su -p x -k su_cmd

## Account and configuration changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/hosts -p wa -k system_conf
-w /etc/hostname -p wa -k system_conf
-w /etc/resolv.conf -p wa -k system_conf
-w /etc/issue -p wa -k system_conf
-w /etc/network/ -p wa -k system_conf

## Time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -F key=time_change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -F key=time_change

## Audit SSH connections and changes
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /var/log/auth.log -p wa -k ssh_login

## Audit usage of remote tools (e.g., SSH, netcat)
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/nc -k nc_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/nc -k nc_process

## Audit privileged access
-a always,exit -F arch=b64 -S setuid -S setgid -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -S setgid -k privilege_escalation
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/sudoers.d/ -p wa -k sudoers_changes
-w /bin/sudo -p x -k sudo_command

## Monitor credential changes
#-w /root/.ssh/ -p wa -k ssh_keys
#-w /home/*/.ssh/ -p wa -k ssh_keys

## Audit use of remote network services
-a always,exit -F arch=b64 -S socket -F success=1 -k socket_connect
-a always,exit -F arch=b32 -S socket -F success=1 -k socket_connect

# Log package installation and removal via dpkg
-w /usr/bin/dpkg -p x
-w /usr/sbin/apt-get -p x
-w /usr/bin/apt -p x
</syntaxhighlight>This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131, it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks
[[index.php?title=Category:Security]]
[[index.php?title=Category:Hardening]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2025-12-16T14:38:36Z

Blackcat568: /* nftables config: */

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.

* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

===== Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build). =====
Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

# 1. Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.
# If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to type long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>
# Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.
# Avoid using the superuser account or sudo without a clear necessity — and never execute arbitrary scripts with sudo. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
## Always read a script fully before running it (less script.sh, cat script.sh).
## Never paste commands from untrusted or unverified sources into the terminal.
## Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
## Follow the principle of least privilege — create separate user accounts and limit access rights where possible Important: Improper or careless use of sudo and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.
# Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. You may also consider switching to SELinux. If you have difficulty configuring AppArmor or SELinux, seek help from specialists or use AI-based tools. My SELinux configuration is attached below (I use SELinux on Debian 12 — it works reliably).
# Use advanced network filtering settings: iptables or nftables, or a commercial firewall. (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#nftables config:|nftables config]]
# Configure kernel parameters for maximum security (sysctl hardening). (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#sysctl config:|sysctl config]])
# Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event). (sample [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#auditd rules config:|auditd rules config]]
# Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.
# If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.
# Follow the principle of Attack Surface Reduction (or Occam's_razor) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
## If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
## If you are certain you will never use it, remove it completely from the system.
## This practice reduces potential attack vectors and strengthens overall system security.
## Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications. Always create a full system backup before making any significant configuration changes or modifications.
# Perform regular antivirus and anti-rootkit scans of the system. In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.
# Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:
<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

'''Related Aspects of Internet Security'''

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

1. Store passwords in a reliable password manager.

'''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:

* relying on human memory, with the risk of forgetting or confusing credentials;
* storing passwords on paper media, which can be damaged, lost, or stolen;
* saving passwords in web browsers in unencrypted form;
* keeping passwords in plain text files on the desktop or in other directories without encryption;
* and similar approaches.

Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.

A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.

Regularly create up-to-date backups of the ''encrypted'' password database.

Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.

Additional Practical Recommendations

A password manager (for example, KeePassXC) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.

In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.

It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).

2. Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [[wikipedia:Authenticator_app|Authenticator_app]]), or a hardware security key such as a [[wikipedia:YubiKey|YubiKey]].

This is a critical cybersecurity measure — neglecting it can completely undermine all your efforts in configuring a secure Linux system.

The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:

* YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
* It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
* Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number. For now, it is one of the most reliable hardware-based options for two-factor authentication.

3. Using VPN to improve privacy and security

''If you are a private user'', you can also configure a system-wide VPN (for example, ProtonVPN) so that all device traffic is routed through it — not only browser traffic or traffic from specific applications.

Enable the “killswitch” mode and disable it only when necessary, re-enabling it immediately afterwards.

It is also recommended to periodically change VPN servers, doing so at different and unpredictable intervals.

Using a VPN increases your privacy: all of your traffic will be encrypted from observers on your local network and from your internet service provider. This makes it more difficult for an attacker to apply certain social-engineering methods based on traffic analysis, and it also helps protect your privacy in the event that your provider’s infrastructure is compromised.

''If you own a server'' and want access to it to be available only to trusted private or legal entities, while also increasing its protection against unauthorized access, you can configure the server so that SSH and other internal services are accessible exclusively through OpenVPN using TLS authentication (tls-auth / tls-crypt) and unique client certificates instead of passwords.

4. Actively study and apply artificial intelligence to improve security configurations in Debian and other Linux distributions, as well as to address related cybersecurity tasks. A lack of knowledge often becomes the weakest link; AI can provide accurate, structured recommendations interactively and help automate repetitive or complex operations.

5. If privacy is a priority, consider reducing reliance on the Google ecosystem and switching to more privacy-focused alternatives (for example, proton.me and similar services). Google provides very strong security, but its services collect extensive telemetry for analysis. While this data is encrypted and not accessible to attackers, it may still be undesirable for users who value strict privacy.

''Always verify AI-generated recommendations before applying them in production environments. Test any changes in an isolated system, review generated commands or configurations, and ensure that suggestions align with your threat model and security architecture.''

''In practice, users who effectively leverage AI tools are significantly better prepared, and the adoption of such technologies makes malicious activity considerably more difficult for attackers.''

'''''Note:''' Artificial intelligence tools are mentioned here as optional technical aids, not as an endorsement of any specific service or vendor.''

6. It is also important to consider the possibility of hardware-level attacks.

Although such attacks are significantly less common and typically require more resources than software-based attacks, they remain a potential threat. In certain scenarios, an adversary may exploit vulnerabilities in device firmware or conduct a combined attack targeting both software and hardware layers. Examples include remote injection of malicious code into the firmware of a motherboard, router, optical modem, or other hardware components.

If, after a thorough software-level audit, a security issue remains unresolved, it is advisable <nowiki>'''</nowiki>to perform a hardware-level assessment<nowiki>'''</nowiki> as well, including verification of device firmware integrity and configuration.

<blockquote>'''And most importantly — give up the illusion of complete security. We live in conditions of a severe information war, and everyone must make efforts so that malicious actors cannot freely spy on desktops and servers.'''</blockquote>

'''Examples of Deep Custom Security Configurations'''

Below are examples of strong, individualized configurations for '''SELinux''', '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

====== SELinux config: ======
<syntaxhighlight lang="terminfo">
root@user:/home/user# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
root@user:/home/user# sestatus -v
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

Process contexts:
Current context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Init context: system_u:system_r:init_t:s0
/sbin/agetty system_u:system_r:getty_t:s0

File contexts:
Controlling terminal: unconfined_u:object_r:user_devpts_t:s0
/etc/passwd system_u:object_r:etc_t:s0
/etc/shadow system_u:object_r:unlabeled_t:s0
/bin/bash system_u:object_r:shell_exec_t:s0
/bin/login system_u:object_r:login_exec_t:s0
/bin/sh system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0
/sbin/agetty system_u:object_r:getty_exec_t:s0
/sbin/init system_u:object_r:bin_t:s0 -> system_u:object_r:init_exec_t:s0
/lib/ld-linux.so.2 system_u:object_r:lib_t:s0 -> system_u:object_r:ld_so_t:s0
</syntaxhighlight>

====== nftables config: ======
<syntaxhighlight lang="bash">
#!/usr/sbin/nft -f

flush ruleset

table inet filter {

# = Main chain policy =
chain input {
type filter hook input priority 0;
policy drop;

# = Common rule set =
# 🌀 Allow loopback interface (internal system processes)
iif "lo" accept

# == 🔁 Allow established and related connections ==
ct state established,related accept

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# == 🔒 Limit the rate of NEW connections per source IP (basic anti-DDoS protection) ==
# If you experience issues with slow or failed page loads in your browser,
# try increasing the limit, for example:
# ip saddr 0.0.0.0/0 ct state new limit rate 50/second burst 100 packets accept
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == 🚫 Blocking SSDP and mDNS (local broadcast discovery protocols) ==
ip daddr 239.255.255.250 udp dport 1900 drop # ❌ SSDP (UPnP/device discovery)
ip daddr 224.0.0.251 udp dport 5353 drop # ❌ mDNS (Bonjour, Avahi)

# == 🛑 Blocking NetBIOS and LLMNR (Windows/systemd internal LAN protocols) ==
udp dport 137 drop # ❌ NetBIOS Name Service (Windows network names)
udp dport 138 drop # ❌ NetBIOS Datagram Service (LAN name discovery)
udp dport 5355 drop # ❌ LLMNR (Link-Local Multicast Name Resolution)

# = Set of blocked IP addresses and ranges =

# == 🧱 Blocking known botnets and proxy networks ==
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} log prefix "🔥 BAN: known bots " flags all
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} drop

# == 🚫 Blocking strange TCP flags (XMAS, NULL scans and others) ==
tcp flags & (fin|syn|rst|psh|ack|urg) == 0 drop # NULL scan
tcp flags & (fin|psh|urg) == (fin|psh|urg) drop # XMAS scan
tcp flags & (fin|syn) == (fin|syn) drop # SYN-ACK scan
tcp flags & (syn|rst|fin) == (syn|rst|fin) drop # Xmas scan
tcp flags & (syn|fin|rst|psh|ack) == (syn|rst|fin|ack) drop # Xmas scan

# == 🚫 Blocking fragmented packets — commonly used in filter evasion ==
ip frag-off & 0x1fff != 0 drop

# == 🔒 Blocking spoofed IP packets ==
ip saddr 127.0.0.0/8 drop # localhost
ip saddr 10.0.0.0/8 drop # private network
ip saddr 172.16.0.0/12 drop # private network
ip saddr 192.168.0.0/16 drop # private network
ip saddr 169.254.0.0/16 drop # APIPA
ip saddr 0.0.0.0/8 drop # invalid address
ip saddr 224.0.0.0/4 drop # multicast
ip saddr 240.0.0.0/5 drop # reserved
}

# = Main chain policy =
chain forward {
type filter hook forward priority 0;
policy accept;

# = Blocking various types of attacks =
# Required in chain forward only if Docker or Oracle VirtualBox is present.
# If needed — uncomment.

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
# ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
# ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
# ip protocol icmp icmp type echo-request limit rate 1/second accept
# ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
# ip protocol icmp icmp type echo-request drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports required for application operation ==
tcp dport {
53, # DNS — needed for domain name resolution
80, # HTTP — web traffic, updates and resource loading
443, # HTTPS — secure web traffic, VPN, browser
12043, # Custom 3D Application — specific client port
13000-13050 # Custom 3D Application — dynamic client port range
} accept

# == Allow UDP ports required for application operation ==
udp dport {
53, # DNS — needed for domain name resolution
443, # HTTPS via QUIC/HTTP3, browser protocols
3478, # STUN/TURN — WebRTC and video calls
3479-3481 # STUN/TURN — WebRTC and video calls
} accept

# = Blocking dangerous and unnecessary TCP/UDP ports and ranges =

# These blocklists are intended for a DESKTOP / workstation.
# They block remote access, outdated services, proxies, DBs, IoT, and ports
# often used by malware, scanners, and C2 infrastructures.
#
# ⚠ If you use the system as a SERVER, enable IP forwarding,
# or run services with internal routing
# (Docker NAT/bridge, VirtualBox host-only/bridged, VPN clients),
# carefully review the blocked ports/ranges in the forward chain —
# these services may need extra ports.
# Adjust or comment out required items if necessary.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high risk) ===
22, # SSH — common brute-force target
23, # Telnet — outdated, no encryption
3389, # RDP — Windows remote desktop
5900, # VNC — remote access, frequent vulnerabilities
# === FTP / SMB / NetBIOS (unsafe file-sharing protocols) ===
21, # FTP — insecure protocol
137, # NetBIOS Name Service
138, # NetBIOS Datagram
139, # NetBIOS Session
445, # SMB/CIFS — common exploit target
# === Databases (NEVER expose to the Internet) ===
3306, # MySQL/MariaDB
1433, # MS SQL Server
1434, # MS SQL Browser
# === HTTP-alt/Proxy/Elasticsearch (exploited frequently) ===
8080, # HTTP proxy / web interfaces — often exposed accidentally
9200, # Elasticsearch API — full remote data access
# === UPnP/IoT (insecure by design) ===
1900, # SSDP / UPnP
# === Common for malware (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell
5555, # Android ADB / IoT botnets
9001, # Tor transport (used by malware)
1234, # Netcat / reverse connections
1337, # Common C2 port used by malware
# === ⚠️ Scanner ports and potentially vulnerable services ===
1080, # SOCKS proxy — used to bypass filtering
3128, # Squid proxy — may be abused as open proxy
8000, # Alternative HTTP ports, dev servers
8888, # Web interfaces, proxies, dev tools
10000 # Webmin — remote admin panel, frequent attacks
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; abused by attackers
162 # SNMP Trap — also potentially vulnerable
} drop

# Attention! Blocking wide port ranges — be careful!
# Do not break system or application functionality!

# == TCP port ranges not used by a workstation during transit routing ==
# Blocked to prevent unwanted forwarding, hidden tunnels,
# NAT evasion, parasitic flows, and potential forward-path attacks.

tcp dport {
1024-2047, # System/legacy services; rarely needed in forward
2048-4095, # Proprietary daemons; NFS (2049) — check if used
4096-8191, # Old VPNs, some games, P2P; rarely needed on desktop
8192-12287, # Alternative HTTP/proxy, multimedia; test as needed
12288-16383, # Media/VoIP (TCP fallback); may break calls
16384-24575, # RTP/WebRTC (TCP fallback); block unless AV needed
24576-32767, # Dynamic ranges for games/VPN; may cause issues
32768-49151, # Registered/ephemeral; risky — may break NAT, Docker, VM
49152-65535 # High ephemeral; widely used by modern apps
} drop

# == 🚫 Blocking UDP ports — high and dynamic ranges ==
udp dport {
1024-9999, # low/mid ephemeral ports; used by trojans, P2P, games, VPN
10000-65535 # high ephemeral; used by dynamic apps, VPN, Docker
} drop

# = 🕷️ Suspicious IPs — large ranges often used by botnets, spam nets, and scanners =
ip saddr {
185.0.0.0/8, # abused hosting and proxy networks
37.0.0.0/8, # cheap VPS, frequent scanning sources
88.0.0.0/8, # common brute-force and scanner range
77.0.0.0/8, # TOR/proxy nodes
91.0.0.0/8 # botnets and “grey-zone” hosting
} drop
}

chain output {
# = Main chain policy =
type filter hook output priority 0;
policy accept;

# = Blocking various types of attacks =

# == 🔒 Limiting new connections from a single IP (anti-DDoS) ==
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# = ICMP protocol restrictions =

# == 🛡️ Ping limitation ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == Critically important ICMP for network ==
ip protocol icmp icmp type { destination-unreachable, time-exceeded, parameter-problem } accept

# == Important ICMPv6 for IPv6 ==
ip6 nexthdr icmpv6 icmpv6 type { 1, 2, 3, 4 } accept
ip6 nexthdr icmpv6 icmpv6 type { 135, 136 } accept # NS/NA
ip6 nexthdr icmpv6 icmpv6 type { 133, 134 } accept # RS/RA

# == Drop all other ICMP and ICMPv6 ==
ip protocol icmp drop # drop all other ICMP
ip6 nexthdr icmpv6 drop # drop all other ICMPv6

# = SCTP protocol blocking =
# 99.9% of desktop systems do not use SCTP at all
meta l4proto sctp drop

# = DCCP — Datagram Congestion Control Protocol blocking =
# Not used by any mainstream desktop applications
meta l4proto dccp drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports and ranges required for application functionality ==
tcp dport {
53, # DNS client. Required for Internet to work: domain name resolution (UDP/TCP).
80, # HTTP traffic to unencrypted websites; apps may use it for API/redirects.
443, # HTTPS. Main port for all encrypted web traffic — browsers, API, VPN, updates.
3306, # MySQL client. Needed if you connect to MySQL.
3478, # STUN/TURN WebRTC. Needed for audio/video/Discord.
3000, # Node.js dev servers. Needed for development.
3690, # SVN. If you work with an old repository.
4443, # Alternative HTTPS (some APIs). Also used by some VPN/clients.
12043, # Required for Custom 3D Application.
13000-13050 # Required for Custom 3D Application.
} accept

# == Allow UDP ports and ranges required for applications ==
udp dport {
443, # Required for fast and stable operation of modern websites
# (Google, YouTube, ChatGPT, Cloudflare)
13000-13050 # Required for Custom 3D Application.
} accept

# = Blocking potentially dangerous / unnecessary TCP/UDP ports =

# These blocks are intended for a DESKTOP / workstation.
# ⚠ If you use the system as a SERVER —
# adjust or comment out the required ports/ranges as needed.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high-risk) ===
22, # SSH — target of brute-force attacks.
23, # Telnet — outdated, unencrypted.
3389, # RDP — Windows remote access.
5900, # VNC — remote access, often vulnerable.
# === FTP / SMB / NetBIOS (dangerous file-sharing services) ===
21, # FTP — insecure protocol.
137, # NetBIOS Name Service.
138, # NetBIOS Datagram.
139, # NetBIOS Session.
445, # SMB/CIFS — frequent exploitation target.
# === Databases (NEVER open to the Internet) ===
3306, # MySQL/MariaDB.
1433, # MS SQL Server.
1434, # MS SQL Browser.
# === HTTP-alt/Proxy/Elasticsearch (dangerous, often attacked) ===
8080, # HTTP proxy / web interfaces — often exposed test interfaces.
9200, # Elasticsearch API — full remote access to data.
# === UPnP/IoT (vulnerable by design) ===
1900, # SSDP / UPnP.
# === Common malware ports (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell.
5555, # Android ADB / IoT botnets.
9001, # Tor transport (used by malware).
1234, # Netcat / reverse connections.
1337, # Common C2 malware port.
# === ⚠️ Ports of scanners and potentially vulnerable services ===
1080, # SOCKS proxy — often abused for bypassing filters.
3128, # Squid HTTP proxy — can be used as open proxy.
8000, # Alternative HTTP ports, web services — potentially vulnerable.
8888, # Alternative web interfaces — test and proxy ports.
10000 # Webmin — web admin panel, target of attacks.
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; can be abused by attackers.
162 # SNMP Trap — same, potential vulnerability.
} drop

# Warning! ⚠️ Be careful blocking wide port ranges! ⚠️
# Do not break system or application functionality!
# If you need a range — uncomment.
# If you don’t — comment out.

# == Blocking “dangerous” and desktop-unnecessary TCP port ranges ==
tcp dport {
1-1023, # 🛑 Privileged ports.
1024-2047, # r-commands (rlogin, rsh, rexec), old RPC, NFS, legacy daemons.
2048-3071, # Rare proprietary protocols and middleware.
3072-4999, # Mostly ports of legacy, server, corporate apps;
# rarely needed on workstations.
5000-5999, # Alternative services, old P2P/admin ports, rarely used on desktops.
7000-7999, # Alternative/test ports, often used by trojans.
9000-9999, # Web services, proxies, possible backdoor ports.
10000-19998, # Dynamic/high service ports; may be required by some apps like Custom 3D Application,
# but not needed by most desktop services.
19999-32767 # Old ephemeral port range; used by P2P, games, some VPNs,
# but system services rarely use them.
} drop

# == Blocking “dangerous” and desktop-unnecessary UDP port ranges ==
udp dport {
1024-2047, # Old UNIX services, RPC, NFS, r-commands, legacy daemons.
# Usually safe to block.
2048-4095, # Rarely used standard ports, proprietary services.
# Usually safe to block.
4096-8191, # VPN, games, P2P, WebRTC, VoIP of some clients.
# Can block, but cautiously: may affect VPN/apps.
8192-12287, # QUIC/HTTP3, proxies, multimedia protocols.
# Might cause side effects; better test first.
12288-16383, # Old RTP/VoIP ranges and media streams.
# Can block, but might break video calls.
16384-24575, # Main RTP range (audio/video), WebRTC, VoIP.
# ❗ Do not block if you need video calls/WebRTC/VPN.
24576-32767 # Dynamic ports for VPN, P2P, games, streaming data.
# ❗ May break VPN or some apps.
} drop

# == 🕷️ Blocking suspicious IPs —
# large ranges often used by botnets, spam networks, and scanners ==
ip saddr {
185.0.0.0/8, # Abused hosting and proxy networks.
37.0.0.0/8, # Cheap VPS, scanning sources.
88.0.0.0/8, # Frequent brute-force and scanners.
77.0.0.0/8, # Massive TOR/proxy nodes.
91.0.0.0/8 # Botnets and “grey” hosting.
} drop
}
}

</syntaxhighlight>

====== sysctl config: ======
kernel parameters configuration

/etc/sysctl.d/99-protect.conf<syntaxhighlight lang="bash">
# 1 Ignore ICMP on interfaces
net.ipv4.icmp_echo_ignore_all = 1

# 2 Do not respond to ICMP broadcast (against Smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 3 Enable SYN backlog reduction
net.ipv4.tcp_syncookies = 1

# 4 Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 5 Log packets with incorrect routing
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# 6 Disable ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# 7 Disable packet forwarding
net.ipv4.ip_forward = 0

# 8 Disable IPv6 support
net.ipv4.conf.all.disable_ipv6 = 1
net.ipv4.conf.default.disable_ipv6 = 1

# 9 Prevent sending TCP segments with null windows
net.ipv4.tcp_rfc1337 = 1

# 10 Disable ARP filtering for automatic routing
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1

# 11 Limit the maximum size of the incoming TCP window
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# 12 Drop packets with incorrect checksums
net.ipv4.conf.all.drop_unicast_in_l2_multicast = 1
net.ipv4.conf.default.drop_unicast_in_l2_multicast = 1

# 13 Disable IPv6 forwarding
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# 14 Limit the maximum number of SYN packet retries
net.ipv4.tcp_synack_retries = 2

# 15 Increase routing cache lifetime
net.ipv4.route.max_size = 32768
</syntaxhighlight>

====== auditd rules config: ======
/etc/audit/rules.d/audit.rules

<syntaxhighlight lang="bash">
## Flush rules
-D

## Buffers
-b 8192
--backlog_wait_time 60000
-f 1

## Network audit
-a always,exit -F arch=b64 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b64 -S accept4 -F success=1 -k network_accept
-a always,exit -F arch=b32 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b32 -S accept4 -F success=1 -k network_accept

## Logging execve commands
-a always,exit -F arch=b64 -S execve -F key=exec_log

## Audit logins and sessions
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session

## sudo / su
-w /etc/sudoers -p wa -k sudo
-w /etc/sudoers.d/ -p wa -k sudo
-w /bin/su -p x -k su_cmd

## Account and configuration changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/hosts -p wa -k system_conf
-w /etc/hostname -p wa -k system_conf
-w /etc/resolv.conf -p wa -k system_conf
-w /etc/issue -p wa -k system_conf
-w /etc/network/ -p wa -k system_conf

## Time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -F key=time_change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -F key=time_change

## Audit SSH connections and changes
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /var/log/auth.log -p wa -k ssh_login

## Audit usage of remote tools (e.g., SSH, netcat)
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/nc -k nc_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/nc -k nc_process

## Audit privileged access
-a always,exit -F arch=b64 -S setuid -S setgid -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -S setgid -k privilege_escalation
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/sudoers.d/ -p wa -k sudoers_changes
-w /bin/sudo -p x -k sudo_command

## Monitor credential changes
#-w /root/.ssh/ -p wa -k ssh_keys
#-w /home/*/.ssh/ -p wa -k ssh_keys

## Audit use of remote network services
-a always,exit -F arch=b64 -S socket -F success=1 -k socket_connect
-a always,exit -F arch=b32 -S socket -F success=1 -k socket_connect

# Log package installation and removal via dpkg
-w /usr/bin/dpkg -p x
-w /usr/sbin/apt-get -p x
-w /usr/bin/apt -p x
</syntaxhighlight>This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131, it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks
[[index.php?title=Category:Security]]
[[index.php?title=Category:Hardening]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2025-12-16T14:20:07Z

Blackcat568:

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.

* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

===== Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build). =====
Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

# 1. Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.
# If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to type long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>
# Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.
# Avoid using the superuser account or sudo without a clear necessity — and never execute arbitrary scripts with sudo. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
## Always read a script fully before running it (less script.sh, cat script.sh).
## Never paste commands from untrusted or unverified sources into the terminal.
## Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
## Follow the principle of least privilege — create separate user accounts and limit access rights where possible Important: Improper or careless use of sudo and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.
# Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. You may also consider switching to SELinux. If you have difficulty configuring AppArmor or SELinux, seek help from specialists or use AI-based tools. My SELinux configuration is attached below (I use SELinux on Debian 12 — it works reliably).
# Use advanced network filtering settings: iptables or nftables, or a commercial firewall. (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#nftables config:|nftables config]]
# Configure kernel parameters for maximum security (sysctl hardening). (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#sysctl config:|sysctl config]])
# Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event). (sample [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#auditd rules config:|auditd rules config]]
# Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.
# If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.
# Follow the principle of Attack Surface Reduction (or Occam's_razor) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
## If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
## If you are certain you will never use it, remove it completely from the system.
## This practice reduces potential attack vectors and strengthens overall system security.
## Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications. Always create a full system backup before making any significant configuration changes or modifications.
# Perform regular antivirus and anti-rootkit scans of the system. In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.
# Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:
<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

'''Related Aspects of Internet Security'''

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

1. Store passwords in a reliable password manager.

'''Outdated and insecure''' practices for storing passwords are still commonly encountered, including:

* relying on human memory, with the risk of forgetting or confusing credentials;
* storing passwords on paper media, which can be damaged, lost, or stolen;
* saving passwords in web browsers in unencrypted form;
* keeping passwords in plain text files on the desktop or in other directories without encryption;
* and similar approaches.

Such outdated practices should be abandoned in favor of using a modern, reliable password manager that provides proper encryption and access control.

A password manager encrypts the password database, and access to it is possible only after entering a master password, which should be memorized.

Regularly create up-to-date backups of the ''encrypted'' password database.

Do not rely on memory to remember all passwords: strong, attack-resistant passwords are difficult to memorize, while passwords that are easy to remember are generally ''not resistant to compromise''.

Additional Practical Recommendations

A password manager (for example, KeePassXC) can be configured to automatically enter the superuser password into a terminal window. It is strongly recommended to '''strictly bind this automatic input to a specific terminal window''' in order to prevent accidental password entry into another field or application. This approach makes it possible to safely use long, cryptographically strong passwords for privileged operations.

In addition, individual account entries within a password manager can store attached encrypted data, such as text files containing access codes, GPG keys, or passphrases. All such information is stored in encrypted form within a single protected database.

It is essential to use a '''strong master password''' and never share it with others. The password database should not be kept unlocked continuously. After completing the required operations, the database should be closed, or automatic locking should be configured based on specific conditions (such as screen locking or laptop closure) and/or after a defined period of inactivity (for example, 15–30 minutes).

2. Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [[wikipedia:Authenticator_app|Authenticator_app]]), or a hardware security key such as a [[wikipedia:YubiKey|YubiKey]].

This is a critical cybersecurity measure — neglecting it can completely undermine all your efforts in configuring a secure Linux system.

The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:

* YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
* It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
* Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number. For now, it is one of the most reliable hardware-based options for two-factor authentication.

3. Using VPN to improve privacy and security

''If you are a private user'', you can also configure a system-wide VPN (for example, ProtonVPN) so that all device traffic is routed through it — not only browser traffic or traffic from specific applications.

Enable the “killswitch” mode and disable it only when necessary, re-enabling it immediately afterwards.

It is also recommended to periodically change VPN servers, doing so at different and unpredictable intervals.

Using a VPN increases your privacy: all of your traffic will be encrypted from observers on your local network and from your internet service provider. This makes it more difficult for an attacker to apply certain social-engineering methods based on traffic analysis, and it also helps protect your privacy in the event that your provider’s infrastructure is compromised.

''If you own a server'' and want access to it to be available only to trusted private or legal entities, while also increasing its protection against unauthorized access, you can configure the server so that SSH and other internal services are accessible exclusively through OpenVPN using TLS authentication (tls-auth / tls-crypt) and unique client certificates instead of passwords.

4. Actively study and apply artificial intelligence to improve security configurations in Debian and other Linux distributions, as well as to address related cybersecurity tasks. A lack of knowledge often becomes the weakest link; AI can provide accurate, structured recommendations interactively and help automate repetitive or complex operations.

5. If privacy is a priority, consider reducing reliance on the Google ecosystem and switching to more privacy-focused alternatives (for example, proton.me and similar services). Google provides very strong security, but its services collect extensive telemetry for analysis. While this data is encrypted and not accessible to attackers, it may still be undesirable for users who value strict privacy.

''Always verify AI-generated recommendations before applying them in production environments. Test any changes in an isolated system, review generated commands or configurations, and ensure that suggestions align with your threat model and security architecture.''

''In practice, users who effectively leverage AI tools are significantly better prepared, and the adoption of such technologies makes malicious activity considerably more difficult for attackers.''

'''''Note:''' Artificial intelligence tools are mentioned here as optional technical aids, not as an endorsement of any specific service or vendor.''

6. It is also important to consider the possibility of hardware-level attacks.

Although such attacks are significantly less common and typically require more resources than software-based attacks, they remain a potential threat. In certain scenarios, an adversary may exploit vulnerabilities in device firmware or conduct a combined attack targeting both software and hardware layers. Examples include remote injection of malicious code into the firmware of a motherboard, router, optical modem, or other hardware components.

If, after a thorough software-level audit, a security issue remains unresolved, it is advisable <nowiki>'''</nowiki>to perform a hardware-level assessment<nowiki>'''</nowiki> as well, including verification of device firmware integrity and configuration.

<blockquote>'''And most importantly — give up the illusion of complete security. We live in conditions of a severe information war, and everyone must make efforts so that malicious actors cannot freely spy on desktops and servers.'''</blockquote>

'''Examples of Deep Custom Security Configurations'''

Below are examples of strong, individualized configurations for '''SELinux''', '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

====== SELinux config: ======
<syntaxhighlight lang="terminfo">
root@user:/home/user# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
root@user:/home/user# sestatus -v
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

Process contexts:
Current context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Init context: system_u:system_r:init_t:s0
/sbin/agetty system_u:system_r:getty_t:s0

File contexts:
Controlling terminal: unconfined_u:object_r:user_devpts_t:s0
/etc/passwd system_u:object_r:etc_t:s0
/etc/shadow system_u:object_r:unlabeled_t:s0
/bin/bash system_u:object_r:shell_exec_t:s0
/bin/login system_u:object_r:login_exec_t:s0
/bin/sh system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0
/sbin/agetty system_u:object_r:getty_exec_t:s0
/sbin/init system_u:object_r:bin_t:s0 -> system_u:object_r:init_exec_t:s0
/lib/ld-linux.so.2 system_u:object_r:lib_t:s0 -> system_u:object_r:ld_so_t:s0
</syntaxhighlight>

====== nftables config: ======
<syntaxhighlight lang="bash">
#!/usr/sbin/nft -f

flush ruleset

table inet filter {

# = Main chain policy =
chain input {
type filter hook input priority 0;
policy drop;

# = Common rule set =
# 🌀 Allow loopback interface (internal system processes)
iif "lo" accept

# == 🔁 Allow established and related connections ==
ct state established,related accept

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# == 🔒 Limit the rate of NEW connections per source IP (basic anti-DDoS protection) ==
# If you experience issues with slow or failed page loads in your browser,
# try increasing the limit, for example:
# ip saddr 0.0.0.0/0 ct state new limit rate 50/second burst 100 packets accept
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == 🚫 Blocking SSDP and mDNS (local broadcast discovery protocols) ==
ip daddr 239.255.255.250 udp dport 1900 drop # ❌ SSDP (UPnP/device discovery)
ip daddr 224.0.0.251 udp dport 5353 drop # ❌ mDNS (Bonjour, Avahi)

# == 🛑 Blocking NetBIOS and LLMNR (Windows/systemd internal LAN protocols) ==
udp dport 137 drop # ❌ NetBIOS Name Service (Windows network names)
udp dport 138 drop # ❌ NetBIOS Datagram Service (LAN name discovery)
udp dport 5355 drop # ❌ LLMNR (Link-Local Multicast Name Resolution)

# = Set of blocked IP addresses and ranges =

# == 🧱 Blocking known botnets and proxy networks ==
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} log prefix "🔥 BAN: known bots " flags all
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} drop

# == 🚫 Blocking strange TCP flags (XMAS, NULL scans and others) ==
tcp flags & (fin|syn|rst|psh|ack|urg) == 0 drop # NULL scan
tcp flags & (fin|psh|urg) == (fin|psh|urg) drop # XMAS scan
tcp flags & (fin|syn) == (fin|syn) drop # SYN-ACK scan
tcp flags & (syn|rst|fin) == (syn|rst|fin) drop # Xmas scan
tcp flags & (syn|fin|rst|psh|ack) == (syn|rst|fin|ack) drop # Xmas scan

# == 🚫 Blocking fragmented packets — commonly used in filter evasion ==
ip frag-off & 0x1fff != 0 drop

# == 🔒 Blocking spoofed IP packets ==
ip saddr 127.0.0.0/8 drop # localhost
ip saddr 10.0.0.0/8 drop # private network
ip saddr 172.16.0.0/12 drop # private network
ip saddr 192.168.0.0/16 drop # private network
ip saddr 169.254.0.0/16 drop # APIPA
ip saddr 0.0.0.0/8 drop # invalid address
ip saddr 224.0.0.0/4 drop # multicast
ip saddr 240.0.0.0/5 drop # reserved
}

# = Main chain policy =
chain forward {
type filter hook forward priority 0;
policy accept;

# = Blocking various types of attacks =
# Required in chain forward only if Docker or Oracle VirtualBox is present.
# If needed — uncomment.

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
# ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
# ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
# ip protocol icmp icmp type echo-request limit rate 1/second accept
# ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
# ip protocol icmp icmp type echo-request drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports required for application operation ==
tcp dport {
53, # DNS — needed for domain name resolution
80, # HTTP — web traffic, updates and resource loading
443, # HTTPS — secure web traffic, VPN, browser
12043, # Custom 3D Application — specific client port
13000-13050 # Custom 3D Application — dynamic client port range
} accept

# == Allow UDP ports required for application operation ==
udp dport {
53, # DNS — needed for domain name resolution
443, # HTTPS via QUIC/HTTP3, browser protocols
3478, # STUN/TURN — WebRTC and video calls
3479-3481 # STUN/TURN — WebRTC and video calls
} accept

# = Blocking dangerous and unnecessary TCP/UDP ports and ranges =

# These blocklists are intended for a DESKTOP / workstation.
# They block remote access, outdated services, proxies, DBs, IoT, and ports
# often used by malware, scanners, and C2 infrastructures.
#
# ⚠ If you use the system as a SERVER, enable IP forwarding,
# or run services with internal routing
# (Docker NAT/bridge, VirtualBox host-only/bridged, VPN clients),
# carefully review the blocked ports/ranges in the forward chain —
# these services may need extra ports.
# Adjust or comment out required items if necessary.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high risk) ===
22, # SSH — common brute-force target
23, # Telnet — outdated, no encryption
3389, # RDP — Windows remote desktop
5900, # VNC — remote access, frequent vulnerabilities
# === FTP / SMB / NetBIOS (unsafe file-sharing protocols) ===
21, # FTP — insecure protocol
137, # NetBIOS Name Service
138, # NetBIOS Datagram
139, # NetBIOS Session
445, # SMB/CIFS — common exploit target
# === Databases (NEVER expose to the Internet) ===
3306, # MySQL/MariaDB
1433, # MS SQL Server
1434, # MS SQL Browser
# === HTTP-alt/Proxy/Elasticsearch (exploited frequently) ===
8080, # HTTP proxy / web interfaces — often exposed accidentally
9200, # Elasticsearch API — full remote data access
# === UPnP/IoT (insecure by design) ===
1900, # SSDP / UPnP
# === Common for malware (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell
5555, # Android ADB / IoT botnets
9001, # Tor transport (used by malware)
1234, # Netcat / reverse connections
1337, # Common C2 port used by malware
# === ⚠️ Scanner ports and potentially vulnerable services ===
1080, # SOCKS proxy — used to bypass filtering
3128, # Squid proxy — may be abused as open proxy
8000, # Alternative HTTP ports, dev servers
8888, # Web interfaces, proxies, dev tools
10000 # Webmin — remote admin panel, frequent attacks
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; abused by attackers
162 # SNMP Trap — also potentially vulnerable
} drop

# Attention! Blocking wide port ranges — be careful!
# Do not break system or application functionality!

# == TCP port ranges not used by a workstation during transit routing ==
# Blocked to prevent unwanted forwarding, hidden tunnels,
# NAT evasion, parasitic flows, and potential forward-path attacks.

tcp dport {
1024-2047, # System/legacy services; rarely needed in forward
2048-4095, # Proprietary daemons; NFS (2049) — check if used
4096-8191, # Old VPNs, some games, P2P; rarely needed on desktop
8192-12287, # Alternative HTTP/proxy, multimedia; test as needed
12288-16383, # Media/VoIP (TCP fallback); may break calls
16384-24575, # RTP/WebRTC (TCP fallback); block unless AV needed
24576-32767, # Dynamic ranges for games/VPN; may cause issues
32768-49151, # Registered/ephemeral; risky — may break NAT, Docker, VM
49152-65535 # High ephemeral; widely used by modern apps
} drop

# == 🚫 Blocking UDP ports — high and dynamic ranges ==
udp dport {
1024-9999, # low/mid ephemeral ports; used by trojans, P2P, games, VPN
10000-65535 # high ephemeral; used by dynamic apps, VPN, Docker
} drop

# = 🕷️ Suspicious IPs — large ranges often used by botnets, spam nets, and scanners =
ip saddr {
185.0.0.0/8, # abused hosting and proxy networks
37.0.0.0/8, # cheap VPS, frequent scanning sources
88.0.0.0/8, # common brute-force and scanner range
77.0.0.0/8, # TOR/proxy nodes
91.0.0.0/8 # botnets and “grey-zone” hosting
} drop
}

chain output {
# = Main chain policy =
type filter hook output priority 0;
policy accept;

# = Blocking various types of attacks =

# == 🔒 Limiting new connections from a single IP (anti-DDoS) ==
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Limiting ping requests ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports and ranges required for application functionality ==
tcp dport {
53, # DNS client. Required for Internet to work: domain name resolution (UDP/TCP).
80, # HTTP traffic to unencrypted websites; apps may use it for API/redirects.
443, # HTTPS. Main port for all encrypted web traffic — browsers, API, VPN, updates.
3306, # MySQL client. Needed if you connect to MySQL.
3478, # STUN/TURN WebRTC. Needed for audio/video/Discord.
3000, # Node.js dev servers. Needed for development.
3690, # SVN. If you work with an old repository.
4443, # Alternative HTTPS (some APIs). Also used by some VPN/clients.
12043, # Required for Custom 3D Application.
13000-13050 # Required for Custom 3D Application.
} accept

# == Allow UDP ports and ranges required for applications ==
udp dport {
443, # Required for fast and stable operation of modern websites
# (Google, YouTube, ChatGPT, Cloudflare)
13000-13050 # Required for Custom 3D Application.
} accept

# = Blocking potentially dangerous / unnecessary TCP/UDP ports =

# These blocks are intended for a DESKTOP / workstation.
# ⚠ If you use the system as a SERVER —
# adjust or comment out the required ports/ranges as needed.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high-risk) ===
22, # SSH — target of brute-force attacks.
23, # Telnet — outdated, unencrypted.
3389, # RDP — Windows remote access.
5900, # VNC — remote access, often vulnerable.
# === FTP / SMB / NetBIOS (dangerous file-sharing services) ===
21, # FTP — insecure protocol.
137, # NetBIOS Name Service.
138, # NetBIOS Datagram.
139, # NetBIOS Session.
445, # SMB/CIFS — frequent exploitation target.
# === Databases (NEVER open to the Internet) ===
3306, # MySQL/MariaDB.
1433, # MS SQL Server.
1434, # MS SQL Browser.
# === HTTP-alt/Proxy/Elasticsearch (dangerous, often attacked) ===
8080, # HTTP proxy / web interfaces — often exposed test interfaces.
9200, # Elasticsearch API — full remote access to data.
# === UPnP/IoT (vulnerable by design) ===
1900, # SSDP / UPnP.
# === Common malware ports (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell.
5555, # Android ADB / IoT botnets.
9001, # Tor transport (used by malware).
1234, # Netcat / reverse connections.
1337, # Common C2 malware port.
# === ⚠️ Ports of scanners and potentially vulnerable services ===
1080, # SOCKS proxy — often abused for bypassing filters.
3128, # Squid HTTP proxy — can be used as open proxy.
8000, # Alternative HTTP ports, web services — potentially vulnerable.
8888, # Alternative web interfaces — test and proxy ports.
10000 # Webmin — web admin panel, target of attacks.
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; can be abused by attackers.
162 # SNMP Trap — same, potential vulnerability.
} drop

# Warning! ⚠️ Be careful blocking wide port ranges! ⚠️
# Do not break system or application functionality!
# If you need a range — uncomment.
# If you don’t — comment out.

# == Blocking “dangerous” and desktop-unnecessary TCP port ranges ==
tcp dport {
1-1023, # 🛑 Privileged ports.
1024-2047, # r-commands (rlogin, rsh, rexec), old RPC, NFS, legacy daemons.
2048-3071, # Rare proprietary protocols and middleware.
3072-4999, # Mostly ports of legacy, server, corporate apps;
# rarely needed on workstations.
5000-5999, # Alternative services, old P2P/admin ports, rarely used on desktops.
7000-7999, # Alternative/test ports, often used by trojans.
9000-9999, # Web services, proxies, possible backdoor ports.
10000-19998, # Dynamic/high service ports; may be required by some apps like Custom 3D Application,
# but not needed by most desktop services.
19999-32767 # Old ephemeral port range; used by P2P, games, some VPNs,
# but system services rarely use them.
} drop

# == Blocking “dangerous” and desktop-unnecessary UDP port ranges ==
udp dport {
1024-2047, # Old UNIX services, RPC, NFS, r-commands, legacy daemons.
# Usually safe to block.
2048-4095, # Rarely used standard ports, proprietary services.
# Usually safe to block.
4096-8191, # VPN, games, P2P, WebRTC, VoIP of some clients.
# Can block, but cautiously: may affect VPN/apps.
8192-12287, # QUIC/HTTP3, proxies, multimedia protocols.
# Might cause side effects; better test first.
12288-16383, # Old RTP/VoIP ranges and media streams.
# Can block, but might break video calls.
16384-24575, # Main RTP range (audio/video), WebRTC, VoIP.
# ❗ Do not block if you need video calls/WebRTC/VPN.
24576-32767 # Dynamic ports for VPN, P2P, games, streaming data.
# ❗ May break VPN or some apps.
} drop

# == 🕷️ Blocking suspicious IPs —
# large ranges often used by botnets, spam networks, and scanners ==
ip saddr {
185.0.0.0/8, # Abused hosting and proxy networks.
37.0.0.0/8, # Cheap VPS, scanning sources.
88.0.0.0/8, # Frequent brute-force and scanners.
77.0.0.0/8, # Massive TOR/proxy nodes.
91.0.0.0/8 # Botnets and “grey” hosting.
} drop
}
}

</syntaxhighlight>

====== sysctl config: ======
kernel parameters configuration

/etc/sysctl.d/99-protect.conf<syntaxhighlight lang="bash">
# 1 Ignore ICMP on interfaces
net.ipv4.icmp_echo_ignore_all = 1

# 2 Do not respond to ICMP broadcast (against Smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 3 Enable SYN backlog reduction
net.ipv4.tcp_syncookies = 1

# 4 Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 5 Log packets with incorrect routing
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# 6 Disable ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# 7 Disable packet forwarding
net.ipv4.ip_forward = 0

# 8 Disable IPv6 support
net.ipv4.conf.all.disable_ipv6 = 1
net.ipv4.conf.default.disable_ipv6 = 1

# 9 Prevent sending TCP segments with null windows
net.ipv4.tcp_rfc1337 = 1

# 10 Disable ARP filtering for automatic routing
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1

# 11 Limit the maximum size of the incoming TCP window
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# 12 Drop packets with incorrect checksums
net.ipv4.conf.all.drop_unicast_in_l2_multicast = 1
net.ipv4.conf.default.drop_unicast_in_l2_multicast = 1

# 13 Disable IPv6 forwarding
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# 14 Limit the maximum number of SYN packet retries
net.ipv4.tcp_synack_retries = 2

# 15 Increase routing cache lifetime
net.ipv4.route.max_size = 32768
</syntaxhighlight>

====== auditd rules config: ======
/etc/audit/rules.d/audit.rules

<syntaxhighlight lang="bash">
## Flush rules
-D

## Buffers
-b 8192
--backlog_wait_time 60000
-f 1

## Network audit
-a always,exit -F arch=b64 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b64 -S accept4 -F success=1 -k network_accept
-a always,exit -F arch=b32 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b32 -S accept4 -F success=1 -k network_accept

## Logging execve commands
-a always,exit -F arch=b64 -S execve -F key=exec_log

## Audit logins and sessions
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session

## sudo / su
-w /etc/sudoers -p wa -k sudo
-w /etc/sudoers.d/ -p wa -k sudo
-w /bin/su -p x -k su_cmd

## Account and configuration changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/hosts -p wa -k system_conf
-w /etc/hostname -p wa -k system_conf
-w /etc/resolv.conf -p wa -k system_conf
-w /etc/issue -p wa -k system_conf
-w /etc/network/ -p wa -k system_conf

## Time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -F key=time_change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -F key=time_change

## Audit SSH connections and changes
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /var/log/auth.log -p wa -k ssh_login

## Audit usage of remote tools (e.g., SSH, netcat)
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/nc -k nc_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/nc -k nc_process

## Audit privileged access
-a always,exit -F arch=b64 -S setuid -S setgid -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -S setgid -k privilege_escalation
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/sudoers.d/ -p wa -k sudoers_changes
-w /bin/sudo -p x -k sudo_command

## Monitor credential changes
#-w /root/.ssh/ -p wa -k ssh_keys
#-w /home/*/.ssh/ -p wa -k ssh_keys

## Audit use of remote network services
-a always,exit -F arch=b64 -S socket -F success=1 -k socket_connect
-a always,exit -F arch=b32 -S socket -F success=1 -k socket_connect

# Log package installation and removal via dpkg
-w /usr/bin/dpkg -p x
-w /usr/sbin/apt-get -p x
-w /usr/bin/apt -p x
</syntaxhighlight>This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131, it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks
[[index.php?title=Category:Security]]
[[index.php?title=Category:Hardening]]

Security Hardening for Debian Users: Protecting Against Targeted Attacks

2025-12-16T14:09:17Z

Blackcat568:

== Security Hardening for Debian Users: Protecting Against Targeted Attacks ==

==== Cybersecurity Measures Against Targeted Attacks ====

* This guide is based on personal experience with targeted attacks originating from state-sponsored actors associated with a totalitarian regime.

* The goal is to help users strengthen the security posture of Linux systems against advanced persistent threats.
* This article is intended for private users, owners of laptops and desktop computers, as well as administrators of small private servers. Corporate network security topics are not covered here.
* Likewise, this article does not address social engineering, psychological, legal, physical, or other important aspects of targeted attacks. It focuses exclusively on the cybersecurity aspects of Linux-based systems.

==== Description of the Threat ====
Since 2011 (for over 14 years), the author has been targeted by a complex set of attacks that include system intrusions, surveillance, psychological pressure, and blackmail based on personal data obtained through such surveillance.

Attackers can gain full control over a PC and steal personal information, often leaving almost no traces. Occasionally, such activity manifests as sudden cursor movements, system slowdowns, or unexplained network activity.

They also monitor Internet traffic and can compromise passwords when those passwords are weak or when two-factor authentication is not enabled.

Please note that such targeted attacks against individuals — both within and outside of authoritarian states — are a real and growing threat. What author describes is not speculation, but the result of many years of firsthand experience resisting cyberattacks and attempted extortion.

There is a widespread belief that targeted cyberattacks affect only a very small fraction of users — around 0.01% or even less — and that for the overwhelming majority of people such risks are not a real concern. However, events of recent years demonstrate that the level of cyber threats is significantly higher than commonly assumed and is often underestimated by both professionals and ordinary users.

The author, as a citizen of a country that has become a zone of increased interest from external actors employing a wide range of means — from traditional instruments of influence to cyber technologies aimed at compromising and monitoring private devices and servers — considers it necessary to draw the attention of the international community to this issue.

Raising awareness about cyber threats and improving the understanding of modern attack methods are essential steps toward strengthening digital security, protecting personal data, and maintaining trust in open-source infrastructure.

==== Countermeasures ====

===== Tested environment: Debian 12 (Bookworm), kernel 6.1.0-34-amd64 (April 2025 build). =====
Since early 2025, the author has fully switched to Linux, using the Debian distribution. The author is writing here because, among Linux users, it is possible to discuss real protective measures and digital independence.

At the same time, please share this information with Windows users, explaining how vulnerable Windows systems are to hacking and why switching to Ubuntu or another Linux distribution is a much safer choice.

Linux, due to its modular architecture and open-source nature, enables deeper and more flexible security configurations.

Another significant risk factor is the practice of installing Windows, Microsoft Office, or other user applications from pirated sources. Such unofficial builds '''may contain embedded backdoors, trojans, rootkits, or other forms of malware''', which substantially weaken the security of a Windows system and make various types of attacks easier for an adversary.

Debian and most Linux distributions (Ubuntu, Linux Mint, Mageia, Fedora, etc.) are distributed free of charge and rely on official repositories for downloading and installing software. Packages in these repositories undergo strict verification, which greatly reduces the likelihood of malicious code and provides a more predictable and transparent security model.

However, installing Debian or any other Linux distribution alone does not guarantee protection from surveillance — proper configuration is essential.

The adversary type described in this article is '''experienced and resourceful'''. Such actors develop software capable of bypassing default configurations of operating systems — both Linux and Windows. This is profitable: a successful "universal key" or exploit that works against many default deployments can grant stealthy access to a large number of machines.

At the same time, creating such a universal key for systems with complex, individualized security configurations is substantially harder and often impractical: each machine will have a different set of rules, profiles and policies, and the exploit must be adapted per configuration. That significantly raises the attacker's cost.<blockquote>'''Conclusion: do not leave a freshly installed system with default security settings. Apply deliberate, deep, and individualized hardening — least-privilege policies, properly configured access control mechanisms (AppArmor/SELinux), strict firewall rules, verified update policies and monitoring. This increases the attacker's cost and complexity and makes automated widespread exploitation much harder.'''</blockquote>

Carefully and conscientiously harden your system security settings. Prepare the system not only to withstand common, predictable attacks (for example, unauthorized access to a banking account), but also to detect and mitigate non-standard attacks (like those described in this article) '''so they do not catch you off guard'''.

Apply the most secure configurations available, especially if you store sensitive personal or professional information.

Below, the author shares methods for configuring Debian 12 (and other Linux systems) to strengthen protection against hacking and unauthorized access.

This article is written both as a security recommendation and as a request for advice on improving system configuration.

If you have suggestions for enhancing the existing configurations or additional cybersecurity recommendations that may not have been considered in this message, the author would greatly appreciate your expertise and feedback.

==== Practical Instructions ====

===== Linux system hardening recommendations: =====

# 1. Use full-disk encryption. If your PC or laptop is stolen, the attacker will face significant difficulties in gaining access to any private data stored on your hard drive.
# If the OS is installed on a desktop that does not serve as a server, disable and remove all remote access services. They should not merely be password-protected or disabled — completely remove them from the system. If you do need a remote-access service, use strong passwords of 16–20 characters. Also, use complex passwords for both the regular user session and the superuser account — at least 16 characters for the user and at least 20 for the superuser.<blockquote>'''Important''': Do not hesitate to use long passwords. Apply them even if your PC or server is physically isolated. If access to the user or superuser session is not protected by strong, lengthy passwords, the entire Linux security architecture becomes meaningless.</blockquote>
# Use only official repositories of your distribution to install software. Whenever possible, install packages via the package manager (apt/apt-get in Debian) from official repositories — this ensures automatic security updates and integrity verification of packages. If you connect a third-party repository, make sure it is trustworthy: check who maintains it, whether packages are signed with a GPG key, if it is available via HTTPS, and whenever possible, import and verify trusted keys manually. When installing software manually (downloading .deb packages, binaries, or source code), always verify the source: compare checksums (SHA256), verify digital signatures, and follow official installation instructions from the software provider.
# Avoid using the superuser account or sudo without a clear necessity — and never execute arbitrary scripts with sudo. Always carefully review commands before running them in the terminal. The terminal is a powerful administrative tool, but in inexperienced hands it can cause serious system damage or compromise. Practical recommendations:
## Always read a script fully before running it (less script.sh, cat script.sh).
## Never paste commands from untrusted or unverified sources into the terminal.
## Use sudo only when truly necessary; consider using sudoedit for editing configuration files.
## Follow the principle of least privilege — create separate user accounts and limit access rights where possible Important: Improper or careless use of sudo and manual installation of software from untrusted sources are common causes of data leaks, data loss, and system compromise. Always test any configuration changes in an isolated environment before applying them on a production machine.
# Use application confinement tools such as AppArmor; do not leave profiles at their defaults — customize and harden profiles to match your actual workflows. You may also consider switching to SELinux. If you have difficulty configuring AppArmor or SELinux, seek help from specialists or use AI-based tools. My SELinux configuration is attached below (I use SELinux on Debian 12 — it works reliably).
# Use advanced network filtering settings: iptables or nftables, or a commercial firewall. (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#nftables config:|nftables config]]
# Configure kernel parameters for maximum security (sysctl hardening). (''sample'' [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#sysctl config:|sysctl config]])
# Use IDS/IPS systems — intrusion detection and prevention systems (examples: audit, OSSES, Wazus, AIDE). These tools can detect and log attacker activity within your system or network, as well as block malicious actions (logging each blocking event). (sample [[Security Hardening for Debian Users: Protecting Against Targeted Attacks#auditd rules config:|auditd rules config]]
# Test the system for vulnerabilities using scanners (for example, DebPkg:lynis, OpenVAS, Nessus). Test results can be analyzed using tools and, if necessary, AI — provide the logs for review.
# If you suspect that you are being targeted by a focused or targeted attack, start periodically capturing network traffic using tools such as tcpdump, Wireshark, or Zeek. The collected logs can then be sent to security specialists or AI-based analysis tools for further investigation. These measures will significantly complicate a hacker’s task and make the unnoticed collection of personal data more difficult.
# Follow the principle of Attack Surface Reduction (or Occam's_razor) — disable all unnecessary daemons, services, and processes that are not required for your workflow.
## If there is a possibility you might need a service, daemon, or process in the future, disable it and remove it from autostart.
## If you are certain you will never use it, remove it completely from the system.
## This practice reduces potential attack vectors and strengthens overall system security.
## Before removing unnecessary daemons, services, or applications, make sure that their removal will not break dependencies with other system components or applications. Always create a full system backup before making any significant configuration changes or modifications.
# Perform regular antivirus and anti-rootkit scans of the system. In targeted attacks, adversaries typically rely on passive or covert methods — such as data interception, monitoring, traffic analysis, and minimal system interference that leaves few or no traces. Nevertheless, periodic antivirus and anti-rootkit scanning remains a valuable preventive measure, helping to detect known threats in time and maintain the overall security posture of the system.
# Always record every change you make in system and application configuration files. Add the note as a comment directly in the configuration file — either above the modified line or after it. Format: # YYYY-MM-DD HH:MM, short description of the change, reason Example: Editing `sshd_config` to disable root login via SSH:
<syntaxhighlight lang="bash">
bash

PermitRootLogin no
# 2025-11-09 14:35, root login via SSH disabled, system security enhancement
</syntaxhighlight>Why it matters:

* Allows you to quickly understand when and why a change was made.
* Helps troubleshoot future issues — you can easily identify which change may have caused a failure or conflict.
* Simplifies system audits and security reviews.

'''Related Aspects of Internet Security'''

There are aspects of Internet security which, if neglected, can significantly reduce or completely nullify all your efforts in configuring and securing your operating system.

1. Enable two-factor authentication (2FA) on all your online accounts (email, social networks, etc.) — this means confirming your login through a phone call, SMS, a one-time code in a mobile authenticator app (see [[wikipedia:Authenticator_app|Authenticator_app]]), or a hardware security key such as a [[wikipedia:YubiKey|YubiKey]].

This is a critical cybersecurity measure — neglecting it can completely undermine all your efforts in configuring a secure Linux system.

The YubiKey hardware authenticator (USB/NFC key) offers the following advantages:

* YubiKey helps protect against phishing because the device verifies the website domain and will not work on fake or look-alike sites.
* It is virtually impossible to hack remotely or over the network, unlike apps, if your phone or backup password is compromised.
* Additionally, YubiKey is not vulnerable to SIM-swap attacks like SMS-based 2FA, as it is not tied to a phone number. For now, it is one of the most reliable hardware-based options for two-factor authentication.

2. Using VPN to improve privacy and security

''If you are a private user'', you can also configure a system-wide VPN (for example, ProtonVPN) so that all device traffic is routed through it — not only browser traffic or traffic from specific applications.

Enable the “killswitch” mode and disable it only when necessary, re-enabling it immediately afterwards.

It is also recommended to periodically change VPN servers, doing so at different and unpredictable intervals.

Using a VPN increases your privacy: all of your traffic will be encrypted from observers on your local network and from your internet service provider. This makes it more difficult for an attacker to apply certain social-engineering methods based on traffic analysis, and it also helps protect your privacy in the event that your provider’s infrastructure is compromised.

''If you own a server'' and want access to it to be available only to trusted private or legal entities, while also increasing its protection against unauthorized access, you can configure the server so that SSH and other internal services are accessible exclusively through OpenVPN using TLS authentication (tls-auth / tls-crypt) and unique client certificates instead of passwords.

3. Actively study and apply artificial intelligence to improve security configurations in Debian and other Linux distributions, as well as to address related cybersecurity tasks. A lack of knowledge often becomes the weakest link; AI can provide accurate, structured recommendations interactively and help automate repetitive or complex operations.

4. If privacy is a priority, consider reducing reliance on the Google ecosystem and switching to more privacy-focused alternatives (for example, proton.me and similar services). Google provides very strong security, but its services collect extensive telemetry for analysis. While this data is encrypted and not accessible to attackers, it may still be undesirable for users who value strict privacy.

''Always verify AI-generated recommendations before applying them in production environments. Test any changes in an isolated system, review generated commands or configurations, and ensure that suggestions align with your threat model and security architecture.''

''In practice, users who effectively leverage AI tools are significantly better prepared, and the adoption of such technologies makes malicious activity considerably more difficult for attackers.''

'''''Note:''' Artificial intelligence tools are mentioned here as optional technical aids, not as an endorsement of any specific service or vendor.''

5. It is also important to consider the possibility of hardware-level attacks.

Although such attacks are significantly less common and typically require more resources than software-based attacks, they remain a potential threat. In certain scenarios, an adversary may exploit vulnerabilities in device firmware or conduct a combined attack targeting both software and hardware layers. Examples include remote injection of malicious code into the firmware of a motherboard, router, optical modem, or other hardware components.

If, after a thorough software-level audit, a security issue remains unresolved, it is advisable <nowiki>'''</nowiki>to perform a hardware-level assessment<nowiki>'''</nowiki> as well, including verification of device firmware integrity and configuration.

<blockquote>'''And most importantly — give up the illusion of complete security. We live in conditions of a severe information war, and everyone must make efforts so that malicious actors cannot freely spy on desktops and servers.'''</blockquote>

'''Examples of Deep Custom Security Configurations'''

Below are examples of strong, individualized configurations for '''SELinux''', '''nftables''', '''sysctl''' and '''auditd'''.

These are not universal templates, but references illustrating advanced system hardening.

====== SELinux config: ======
<syntaxhighlight lang="terminfo">
root@user:/home/user# sestatus
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33
root@user:/home/user# sestatus -v
SELinux status: enabled
SELinuxfs mount: /sys/fs/selinux
SELinux root directory: /etc/selinux
Loaded policy name: default
Current mode: enforcing
Mode from config file: enforcing
Policy MLS status: enabled
Policy deny_unknown status: allowed
Memory protection checking: actual (secure)
Max kernel policy version: 33

Process contexts:
Current context: unconfined_u:unconfined_r:unconfined_t:s0-s0:c0.c1023
Init context: system_u:system_r:init_t:s0
/sbin/agetty system_u:system_r:getty_t:s0

File contexts:
Controlling terminal: unconfined_u:object_r:user_devpts_t:s0
/etc/passwd system_u:object_r:etc_t:s0
/etc/shadow system_u:object_r:unlabeled_t:s0
/bin/bash system_u:object_r:shell_exec_t:s0
/bin/login system_u:object_r:login_exec_t:s0
/bin/sh system_u:object_r:bin_t:s0 -> system_u:object_r:shell_exec_t:s0
/sbin/agetty system_u:object_r:getty_exec_t:s0
/sbin/init system_u:object_r:bin_t:s0 -> system_u:object_r:init_exec_t:s0
/lib/ld-linux.so.2 system_u:object_r:lib_t:s0 -> system_u:object_r:ld_so_t:s0
</syntaxhighlight>

====== nftables config: ======
<syntaxhighlight lang="bash">
#!/usr/sbin/nft -f

flush ruleset

table inet filter {

# = Main chain policy =
chain input {
type filter hook input priority 0;
policy drop;

# = Common rule set =
# 🌀 Allow loopback interface (internal system processes)
iif "lo" accept

# == 🔁 Allow established and related connections ==
ct state established,related accept

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# == 🔒 Limit the rate of NEW connections per source IP (basic anti-DDoS protection) ==
# If you experience issues with slow or failed page loads in your browser,
# try increasing the limit, for example:
# ip saddr 0.0.0.0/0 ct state new limit rate 50/second burst 100 packets accept
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# == 🚫 Blocking SSDP and mDNS (local broadcast discovery protocols) ==
ip daddr 239.255.255.250 udp dport 1900 drop # ❌ SSDP (UPnP/device discovery)
ip daddr 224.0.0.251 udp dport 5353 drop # ❌ mDNS (Bonjour, Avahi)

# == 🛑 Blocking NetBIOS and LLMNR (Windows/systemd internal LAN protocols) ==
udp dport 137 drop # ❌ NetBIOS Name Service (Windows network names)
udp dport 138 drop # ❌ NetBIOS Datagram Service (LAN name discovery)
udp dport 5355 drop # ❌ LLMNR (Link-Local Multicast Name Resolution)

# = Set of blocked IP addresses and ranges =

# == 🧱 Blocking known botnets and proxy networks ==
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} log prefix "🔥 BAN: known bots " flags all
ip saddr {
45.9.20.0/24,
89.248.160.0/19,
185.220.100.0/22,
198.96.155.0/24,
185.107.56.0/24,
185.129.62.0/23
} drop

# == 🚫 Blocking strange TCP flags (XMAS, NULL scans and others) ==
tcp flags & (fin|syn|rst|psh|ack|urg) == 0 drop # NULL scan
tcp flags & (fin|psh|urg) == (fin|psh|urg) drop # XMAS scan
tcp flags & (fin|syn) == (fin|syn) drop # SYN-ACK scan
tcp flags & (syn|rst|fin) == (syn|rst|fin) drop # Xmas scan
tcp flags & (syn|fin|rst|psh|ack) == (syn|rst|fin|ack) drop # Xmas scan

# == 🚫 Blocking fragmented packets — commonly used in filter evasion ==
ip frag-off & 0x1fff != 0 drop

# == 🔒 Blocking spoofed IP packets ==
ip saddr 127.0.0.0/8 drop # localhost
ip saddr 10.0.0.0/8 drop # private network
ip saddr 172.16.0.0/12 drop # private network
ip saddr 192.168.0.0/16 drop # private network
ip saddr 169.254.0.0/16 drop # APIPA
ip saddr 0.0.0.0/8 drop # invalid address
ip saddr 224.0.0.0/4 drop # multicast
ip saddr 240.0.0.0/5 drop # reserved
}

# = Main chain policy =
chain forward {
type filter hook forward priority 0;
policy accept;

# = Blocking various types of attacks =
# Required in chain forward only if Docker or Oracle VirtualBox is present.
# If needed — uncomment.

# == 🔒 Limiting new connections from one IP (anti-DDoS) ==
# ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
# ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
# ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Ping rate limiting ==
# ip protocol icmp icmp type echo-request limit rate 1/second accept
# ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
# ip protocol icmp icmp type echo-request drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports required for application operation ==
tcp dport {
53, # DNS — needed for domain name resolution
80, # HTTP — web traffic, updates and resource loading
443, # HTTPS — secure web traffic, VPN, browser
12043, # Custom 3D Application — specific client port
13000-13050 # Custom 3D Application — dynamic client port range
} accept

# == Allow UDP ports required for application operation ==
udp dport {
53, # DNS — needed for domain name resolution
443, # HTTPS via QUIC/HTTP3, browser protocols
3478, # STUN/TURN — WebRTC and video calls
3479-3481 # STUN/TURN — WebRTC and video calls
} accept

# = Blocking dangerous and unnecessary TCP/UDP ports and ranges =

# These blocklists are intended for a DESKTOP / workstation.
# They block remote access, outdated services, proxies, DBs, IoT, and ports
# often used by malware, scanners, and C2 infrastructures.
#
# ⚠ If you use the system as a SERVER, enable IP forwarding,
# or run services with internal routing
# (Docker NAT/bridge, VirtualBox host-only/bridged, VPN clients),
# carefully review the blocked ports/ranges in the forward chain —
# these services may need extra ports.
# Adjust or comment out required items if necessary.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high risk) ===
22, # SSH — common brute-force target
23, # Telnet — outdated, no encryption
3389, # RDP — Windows remote desktop
5900, # VNC — remote access, frequent vulnerabilities
# === FTP / SMB / NetBIOS (unsafe file-sharing protocols) ===
21, # FTP — insecure protocol
137, # NetBIOS Name Service
138, # NetBIOS Datagram
139, # NetBIOS Session
445, # SMB/CIFS — common exploit target
# === Databases (NEVER expose to the Internet) ===
3306, # MySQL/MariaDB
1433, # MS SQL Server
1434, # MS SQL Browser
# === HTTP-alt/Proxy/Elasticsearch (exploited frequently) ===
8080, # HTTP proxy / web interfaces — often exposed accidentally
9200, # Elasticsearch API — full remote data access
# === UPnP/IoT (insecure by design) ===
1900, # SSDP / UPnP
# === Common for malware (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell
5555, # Android ADB / IoT botnets
9001, # Tor transport (used by malware)
1234, # Netcat / reverse connections
1337, # Common C2 port used by malware
# === ⚠️ Scanner ports and potentially vulnerable services ===
1080, # SOCKS proxy — used to bypass filtering
3128, # Squid proxy — may be abused as open proxy
8000, # Alternative HTTP ports, dev servers
8888, # Web interfaces, proxies, dev tools
10000 # Webmin — remote admin panel, frequent attacks
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; abused by attackers
162 # SNMP Trap — also potentially vulnerable
} drop

# Attention! Blocking wide port ranges — be careful!
# Do not break system or application functionality!

# == TCP port ranges not used by a workstation during transit routing ==
# Blocked to prevent unwanted forwarding, hidden tunnels,
# NAT evasion, parasitic flows, and potential forward-path attacks.

tcp dport {
1024-2047, # System/legacy services; rarely needed in forward
2048-4095, # Proprietary daemons; NFS (2049) — check if used
4096-8191, # Old VPNs, some games, P2P; rarely needed on desktop
8192-12287, # Alternative HTTP/proxy, multimedia; test as needed
12288-16383, # Media/VoIP (TCP fallback); may break calls
16384-24575, # RTP/WebRTC (TCP fallback); block unless AV needed
24576-32767, # Dynamic ranges for games/VPN; may cause issues
32768-49151, # Registered/ephemeral; risky — may break NAT, Docker, VM
49152-65535 # High ephemeral; widely used by modern apps
} drop

# == 🚫 Blocking UDP ports — high and dynamic ranges ==
udp dport {
1024-9999, # low/mid ephemeral ports; used by trojans, P2P, games, VPN
10000-65535 # high ephemeral; used by dynamic apps, VPN, Docker
} drop

# = 🕷️ Suspicious IPs — large ranges often used by botnets, spam nets, and scanners =
ip saddr {
185.0.0.0/8, # abused hosting and proxy networks
37.0.0.0/8, # cheap VPS, frequent scanning sources
88.0.0.0/8, # common brute-force and scanner range
77.0.0.0/8, # TOR/proxy nodes
91.0.0.0/8 # botnets and “grey-zone” hosting
} drop
}

chain output {
# = Main chain policy =
type filter hook output priority 0;
policy accept;

# = Blocking various types of attacks =

# == 🔒 Limiting new connections from a single IP (anti-DDoS) ==
ip saddr 0.0.0.0/0 ct state new limit rate 25/second burst 50 packets accept
ip saddr 0.0.0.0/0 ct state new log prefix "🔥 BAN: too many conn " flags all
ip saddr 0.0.0.0/0 ct state new drop

# == 🛡️ Limiting ping requests ==
ip protocol icmp icmp type echo-request limit rate 1/second accept
ip protocol icmp icmp type echo-request log prefix "🔥 BAN: ICMP flood " flags all
ip protocol icmp icmp type echo-request drop

# = Allowing required TCP/UDP ports and ranges =

# == Allow TCP ports and ranges required for application functionality ==
tcp dport {
53, # DNS client. Required for Internet to work: domain name resolution (UDP/TCP).
80, # HTTP traffic to unencrypted websites; apps may use it for API/redirects.
443, # HTTPS. Main port for all encrypted web traffic — browsers, API, VPN, updates.
3306, # MySQL client. Needed if you connect to MySQL.
3478, # STUN/TURN WebRTC. Needed for audio/video/Discord.
3000, # Node.js dev servers. Needed for development.
3690, # SVN. If you work with an old repository.
4443, # Alternative HTTPS (some APIs). Also used by some VPN/clients.
12043, # Required for Custom 3D Application.
13000-13050 # Required for Custom 3D Application.
} accept

# == Allow UDP ports and ranges required for applications ==
udp dport {
443, # Required for fast and stable operation of modern websites
# (Google, YouTube, ChatGPT, Cloudflare)
13000-13050 # Required for Custom 3D Application.
} accept

# = Blocking potentially dangerous / unnecessary TCP/UDP ports =

# These blocks are intended for a DESKTOP / workstation.
# ⚠ If you use the system as a SERVER —
# adjust or comment out the required ports/ranges as needed.

# == Blocking various suspicious TCP ports ==
tcp dport {
# === Remote access (high-risk) ===
22, # SSH — target of brute-force attacks.
23, # Telnet — outdated, unencrypted.
3389, # RDP — Windows remote access.
5900, # VNC — remote access, often vulnerable.
# === FTP / SMB / NetBIOS (dangerous file-sharing services) ===
21, # FTP — insecure protocol.
137, # NetBIOS Name Service.
138, # NetBIOS Datagram.
139, # NetBIOS Session.
445, # SMB/CIFS — frequent exploitation target.
# === Databases (NEVER open to the Internet) ===
3306, # MySQL/MariaDB.
1433, # MS SQL Server.
1434, # MS SQL Browser.
# === HTTP-alt/Proxy/Elasticsearch (dangerous, often attacked) ===
8080, # HTTP proxy / web interfaces — often exposed test interfaces.
9200, # Elasticsearch API — full remote access to data.
# === UPnP/IoT (vulnerable by design) ===
1900, # SSDP / UPnP.
# === Common malware ports (RAT, C2, reverse shells) ===
4444, # Metasploit reverse shell.
5555, # Android ADB / IoT botnets.
9001, # Tor transport (used by malware).
1234, # Netcat / reverse connections.
1337, # Common C2 malware port.
# === ⚠️ Ports of scanners and potentially vulnerable services ===
1080, # SOCKS proxy — often abused for bypassing filters.
3128, # Squid HTTP proxy — can be used as open proxy.
8000, # Alternative HTTP ports, web services — potentially vulnerable.
8888, # Alternative web interfaces — test and proxy ports.
10000 # Webmin — web admin panel, target of attacks.
} drop

# == Blocking various suspicious UDP ports ==
udp dport {
161, # SNMP — network monitoring; can be abused by attackers.
162 # SNMP Trap — same, potential vulnerability.
} drop

# Warning! ⚠️ Be careful blocking wide port ranges! ⚠️
# Do not break system or application functionality!
# If you need a range — uncomment.
# If you don’t — comment out.

# == Blocking “dangerous” and desktop-unnecessary TCP port ranges ==
tcp dport {
1-1023, # 🛑 Privileged ports.
1024-2047, # r-commands (rlogin, rsh, rexec), old RPC, NFS, legacy daemons.
2048-3071, # Rare proprietary protocols and middleware.
3072-4999, # Mostly ports of legacy, server, corporate apps;
# rarely needed on workstations.
5000-5999, # Alternative services, old P2P/admin ports, rarely used on desktops.
7000-7999, # Alternative/test ports, often used by trojans.
9000-9999, # Web services, proxies, possible backdoor ports.
10000-19998, # Dynamic/high service ports; may be required by some apps like Custom 3D Application,
# but not needed by most desktop services.
19999-32767 # Old ephemeral port range; used by P2P, games, some VPNs,
# but system services rarely use them.
} drop

# == Blocking “dangerous” and desktop-unnecessary UDP port ranges ==
udp dport {
1024-2047, # Old UNIX services, RPC, NFS, r-commands, legacy daemons.
# Usually safe to block.
2048-4095, # Rarely used standard ports, proprietary services.
# Usually safe to block.
4096-8191, # VPN, games, P2P, WebRTC, VoIP of some clients.
# Can block, but cautiously: may affect VPN/apps.
8192-12287, # QUIC/HTTP3, proxies, multimedia protocols.
# Might cause side effects; better test first.
12288-16383, # Old RTP/VoIP ranges and media streams.
# Can block, but might break video calls.
16384-24575, # Main RTP range (audio/video), WebRTC, VoIP.
# ❗ Do not block if you need video calls/WebRTC/VPN.
24576-32767 # Dynamic ports for VPN, P2P, games, streaming data.
# ❗ May break VPN or some apps.
} drop

# == 🕷️ Blocking suspicious IPs —
# large ranges often used by botnets, spam networks, and scanners ==
ip saddr {
185.0.0.0/8, # Abused hosting and proxy networks.
37.0.0.0/8, # Cheap VPS, scanning sources.
88.0.0.0/8, # Frequent brute-force and scanners.
77.0.0.0/8, # Massive TOR/proxy nodes.
91.0.0.0/8 # Botnets and “grey” hosting.
} drop
}
}

</syntaxhighlight>

====== sysctl config: ======
kernel parameters configuration

/etc/sysctl.d/99-protect.conf<syntaxhighlight lang="bash">
# 1 Ignore ICMP on interfaces
net.ipv4.icmp_echo_ignore_all = 1

# 2 Do not respond to ICMP broadcast (against Smurf attacks)
net.ipv4.icmp_echo_ignore_broadcasts = 1

# 3 Enable SYN backlog reduction
net.ipv4.tcp_syncookies = 1

# 4 Disable source routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0

# 5 Log packets with incorrect routing
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1

# 6 Disable ICMP Redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0

# 7 Disable packet forwarding
net.ipv4.ip_forward = 0

# 8 Disable IPv6 support
net.ipv4.conf.all.disable_ipv6 = 1
net.ipv4.conf.default.disable_ipv6 = 1

# 9 Prevent sending TCP segments with null windows
net.ipv4.tcp_rfc1337 = 1

# 10 Disable ARP filtering for automatic routing
net.ipv4.conf.all.arp_filter = 1
net.ipv4.conf.default.arp_filter = 1

# 11 Limit the maximum size of the incoming TCP window
net.ipv4.tcp_rmem = 4096 87380 4194304
net.ipv4.tcp_wmem = 4096 65536 4194304

# 12 Drop packets with incorrect checksums
net.ipv4.conf.all.drop_unicast_in_l2_multicast = 1
net.ipv4.conf.default.drop_unicast_in_l2_multicast = 1

# 13 Disable IPv6 forwarding
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1

# 14 Limit the maximum number of SYN packet retries
net.ipv4.tcp_synack_retries = 2

# 15 Increase routing cache lifetime
net.ipv4.route.max_size = 32768
</syntaxhighlight>

====== auditd rules config: ======
/etc/audit/rules.d/audit.rules

<syntaxhighlight lang="bash">
## Flush rules
-D

## Buffers
-b 8192
--backlog_wait_time 60000
-f 1

## Network audit
-a always,exit -F arch=b64 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b64 -S accept4 -F success=1 -k network_accept
-a always,exit -F arch=b32 -S connect -F success=1 -k network_connect
-a always,exit -F arch=b32 -S accept4 -F success=1 -k network_accept

## Logging execve commands
-a always,exit -F arch=b64 -S execve -F key=exec_log

## Audit logins and sessions
-w /var/log/faillog -p wa -k logins
-w /var/log/lastlog -p wa -k logins
-w /var/run/utmp -p wa -k session
-w /var/log/wtmp -p wa -k session
-w /var/log/btmp -p wa -k session

## sudo / su
-w /etc/sudoers -p wa -k sudo
-w /etc/sudoers.d/ -p wa -k sudo
-w /bin/su -p x -k su_cmd

## Account and configuration changes
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/hosts -p wa -k system_conf
-w /etc/hostname -p wa -k system_conf
-w /etc/resolv.conf -p wa -k system_conf
-w /etc/issue -p wa -k system_conf
-w /etc/network/ -p wa -k system_conf

## Time changes
-a always,exit -F arch=b64 -S adjtimex -S settimeofday -S clock_settime -F key=time_change
-a always,exit -F arch=b32 -S adjtimex -S settimeofday -S stime -S clock_settime -F key=time_change

## Audit SSH connections and changes
-w /etc/ssh/sshd_config -p wa -k ssh_config_change
-w /var/log/auth.log -p wa -k ssh_login

## Audit usage of remote tools (e.g., SSH, netcat)
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b64 -S execve -F exe=/usr/bin/nc -k nc_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/ssh -k ssh_process
-a always,exit -F arch=b32 -S execve -F exe=/usr/bin/nc -k nc_process

## Audit privileged access
-a always,exit -F arch=b64 -S setuid -S setgid -k privilege_escalation
-a always,exit -F arch=b32 -S setuid -S setgid -k privilege_escalation
-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/sudoers.d/ -p wa -k sudoers_changes
-w /bin/sudo -p x -k sudo_command

## Monitor credential changes
#-w /root/.ssh/ -p wa -k ssh_keys
#-w /home/*/.ssh/ -p wa -k ssh_keys

## Audit use of remote network services
-a always,exit -F arch=b64 -S socket -F success=1 -k socket_connect
-a always,exit -F arch=b32 -S socket -F success=1 -k socket_connect

# Log package installation and removal via dpkg
-w /usr/bin/dpkg -p x
-w /usr/sbin/apt-get -p x
-w /usr/bin/apt -p x
</syntaxhighlight>This article was written by blackcat568 on the forums: https://forums.debian.net/viewtopic.php?t=164131, it is initially shared on the Debian Wiki: https://wiki.debian.org/Security/ProtectingAgainstTargetedAttacks
[[index.php?title=Category:Security]]
[[index.php?title=Category:Hardening]]