A new server is built to be easy to set up, not to be safe. The installer turns on services you may never use, ships a vendor account whose password is printed in the manual, and leaves management interfaces open. Each of those defaults is a door an attacker can try.
Hardening is the work of closing those doors, and a secure baseline is the written standard that says which ones must be closed on every system. On the CompTIA Security+ SY0-801 exam this sits under objective 4.1, which expects you to apply mitigating controls in a scenario, including hardening and operating system security through Group Policy and Security-Enhanced Linux (SELinux). This lesson covers where baselines come from, the core hardening steps, how to audit a Linux server against its baseline, how Group Policy enforces a Windows baseline, and how SELinux confines Linux services.
A secure baseline is the documented configuration every system must match
A secure baseline is a written, tested set of configuration settings for one kind of system: Windows 11 workstations, RHEL 9 web servers, one model of core switch. Every new system is built to it, and every running system is measured against it.
Few organizations write a baseline from scratch. The common starting points are:
- CIS Benchmarks from the Center for Internet Security, consensus-built guides for operating systems, browsers, databases, network devices and cloud accounts. Level 1 settings suit nearly every system; Level 2 adds stricter settings for high-security environments that may reduce functionality.
- Vendor guides, such as Microsoft's security baselines, which ship as importable Group Policy Objects in the Security Compliance Toolkit.
- DISA Security Technical Implementation Guides (STIGs), required for U.S. Department of Defense systems and widely used by defense contractors.
The organization adjusts the chosen guide and documents each deviation; a setting skipped because it breaks a business application is an accepted risk.
A baseline must also be enforced, through Group Policy on Windows, configuration management tools such as Ansible on Linux, and hardened images in the cloud, and then monitored, because systems drift as people make one-off changes. Scanning against a benchmark is covered in the monitoring section.
On the exam, wording like "configure all new servers consistently", "an industry-accepted configuration standard" or "the configuration has drifted" points to secure baselines.
Hardening removes what a system doesn't need and locks down what it keeps
Every service, package and account is attack surface. The first hardening principle is subtraction: if the role doesn't need something, remove it, or at least disable it. Start by seeing what is listening:
$ sudo ss -tulpn # output trimmed
tcp LISTEN 0.0.0.0:22 users:(("sshd",pid=812))
tcp LISTEN 0.0.0.0:21 users:(("vsftpd",pid=901))
tcp LISTEN 127.0.0.1:631 users:(("cupsd",pid=744))
$ sudo systemctl disable --now vsftpd cups
$ sudo dnf remove vsftpd cups
A web server has no reason to run an FTP server or a print service. Disabling stops them; removing the packages means nobody can quietly bring them back. The Windows equivalent: since the PrintNightmare vulnerabilities of 2021, the standard advice is to disable the Print Spooler service on domain controllers and servers that don't print.
The rest of the core checklist:
- Default credentials. Change every default password and disable or rename default accounts before a system touches the network. The Mirai botnet of 2016 was built from cameras and routers that still accepted factory logins such as admin/admin.
- Unneeded accounts. Disable guest accounts, remove leavers' accounts, and give administrators separate admin and everyday accounts.
- Unused ports and protocols. Replace Telnet (TCP 23), plain HTTP management and SNMPv1/v2c with SSH, HTTPS and SNMPv3.
- Patching. Apply operating system, firmware and application updates on a defined schedule; prioritizing them is covered in the vulnerability management section.
- Host firewall. Deny inbound by default and allow only the ports the role needs.
- Full-disk encryption. BitLocker, FileVault and LUKS protect the data on a lost or stolen device.
- Logging. Audit logons, privilege use and configuration changes, and forward logs to a central collector so an intruder can't simply erase them.
Notice the order of preference. Removing a service beats disabling it, disabling beats blocking it with a firewall rule, and blocking beats only monitoring it. A firewall rule in front of an unneeded service still leaves vulnerable code installed.
Auditing a Linux server against its baseline compares the live system with the written standard
A server that matched the baseline on the day it was built may not match it six months later. Four read-only checks cover the service and account items on most Linux baselines. The first is the full listener list, compared line by line with the services the baseline approves for this role:
$ sudo ss -tulpn
Netid State Recv-Q Send-Q Local Address:Port Peer Address:Port Process
udp UNCONN 0 0 0.0.0.0:161 0.0.0.0:* users:(("snmpd",pid=905,fd=6))
tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=812,fd=3))
tcp LISTEN 0 511 0.0.0.0:443 0.0.0.0:* users:(("nginx",pid=1020,fd=6))
tcp LISTEN 0 151 0.0.0.0:3306 0.0.0.0:* users:(("mysqld",pid=1144,fd=21))
tcp LISTEN 0 511 127.0.0.1:6379 0.0.0.0:* users:(("redis-server",pid=998,fd=6))
tcp LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=812,fd=4))
tcp LISTEN 0 511 [::]:443 [::]:* users:(("nginx",pid=1020,fd=7))