All OpSec guides
OpSecGuide

Linux Hardening Guide

Updated 2026

Factory reset and hardening for sovereignty-focused Linux setups — full-disk encryption, firewall lockdown, and layered defense modules.

Linux baseline path
01
Clean install
LUKS / FDE
02
Core harden
UFW · updates
03
Modules
SSH · AppArmor
04
OpSec ops
Sandbox · audit

1. Factory Reset / Clean Install

  • Perform a fresh install of your distribution (Ubuntu, Debian, Fedora, or Arch recommended).
  • Enable full disk encryption (LUKS) during installation.
  • Use a strong, unique passphrase.

2. Core Hardening

sudo apt update && sudo apt upgrade -y

Install and configure UFW:

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw enable

3. Recommended Hardening Modules

  • SSH hardening
  • Kernel parameter tuning (sysctl)
  • Auditd + logging improvements
  • AppArmor enforcement
  • Automatic security updates

4. Additional OpSec Recommendations

  • Use Firejail or Bubblewrap for application sandboxing
  • Run high-risk tools in a dedicated hardened VM
  • Regularly audit with Lynis

Delta V Intel pipeline — Generated and verified through the Delta V intelligence system.

Explore IntelHub →

Want high-signal intel like this in your inbox?

Get in touch