32. Linux and Network Hardening

32.4 Patching, Users, Permissions and Services

By Ravindra Bagale · Last updated: 27 September 2026

Patching fixes known vulnerabilities – the ones Nessus/OpenVAS found in Chapter 20.

sudo yum check-update                  # what needs updating
sudo yum update -y                     # apply all updates
sudo yum update --security -y          # only security updates (where supported)
sudo yum install -y dnf-automatic 2>/dev/null || true   # automatic updates on newer releases; review before enabling

Users and sudo:

sudo awk -F: '$3==0 {print $1}' /etc/passwd     # only root should have UID 0
sudo awk -F: '($2==""){print $1}' /etc/shadow    # accounts with empty passwords
sudo lastlog | grep -v "Never"                   # who has logged in
sudo userdel -r olduser                          # remove unused accounts
sudo visudo                                      # edit sudo rules safely
sudo chage -M 90 -W 7 deploy                     # password expiry for password users

File permissions:

sudo chmod 600 /etc/ssh/sshd_config
sudo chmod 640 /var/www/html/config.php && sudo chown root:apache /var/www/html/config.php
sudo find / -xdev -perm -4000 -type f 2>/dev/null   # SUID files (privilege escalation, Chapter 26)
sudo find / -xdev -type f -perm -0002 2>/dev/null   # world-writable files

Services: stop and disable what you do not need.

sudo systemctl list-unit-files --type=service --state=enabled
sudo service vsftpd stop && sudo systemctl disable vsftpd
sudo yum remove -y telnet-server rsh-server

Also keep SELinux in enforcing mode on RHEL-family servers (getenforce should print Enforcing) instead of turning it off to "fix" permission errors.