Securing Linux Mint Servers: A Practical Checklist

Introduction to Securing Linux Mint Servers

Linux Mint is widely recognized as a user-friendly desktop distribution, but its Ubuntu-based foundation makes it a surprisingly robust choice for lightweight servers and home labs. However, because Linux Mint is optimized for desktop use out of the box, deploying it as a server requires specific hardening measures. Securing a Linux Mint server involves applying a practical checklist of configurations designed to minimize attack surfaces, enforce strict access controls, and protect system integrity.

Why does this matter? Servers are constantly exposed to automated bots and targeted attacks. A default desktop installation includes services, open ports, and user configurations that are unnecessary and dangerous on a public-facing server. By applying a systematic security checklist, you transform a vulnerable desktop environment into a hardened, production-ready server.

Initial System Setup and Updates

The first step in securing any server is ensuring the underlying software is up to date. Vulnerabilities are discovered daily, and package maintainers frequently release patches. Keeping your system updated mitigates known exploits.

Updating the System

Begin by updating the package lists and upgrading all installed packages to their latest versions. This ensures you are starting with a clean, patched baseline.

sudo apt update && sudo apt upgrade -y
sudo apt autoremove -y

Automatic Security Updates

For ongoing protection, configure the system to install security updates automatically. The unattended-upgrades package handles this seamlessly.

sudo apt install unattended-upgrades apt-listchanges -y
sudo dpkg-reconfigure -plow unattended-upgrades

This command opens a prompt; select "Yes" to enable automatic security updates. You can verify the configuration by checking the log file at /var/log/unattended-upgrades/unattended-upgrades.log.

User Management and Access Control

Running services or logging in as the root user is a major security risk. If an attacker compromises a root session, they have total control. Instead, you should create a standard user with sudo privileges and disable direct root login.

Creating a Non-Root Sudo User

Create a new user account and add it to the sudo group. This user will perform administrative tasks using sudo, which logs commands and requires a password.

sudo adduser serveradmin
sudo usermod -aG sudo serveradmin

Switch to the new user and set up SSH keys for passwordless authentication, which is far more secure than relying on passwords.

su - serveradmin
mkdir ~/.ssh
chmod 700 ~/.ssh
nano ~/.ssh/authorized_keys

Paste your public SSH key into the authorized_keys file, then restrict its permissions.

chmod 600 ~/.ssh/authorized_keys

Securing SSH Access

SSH is the primary gateway into your server. Hardening the SSH daemon (sshd) is critical. Open the configuration file:

sudo nano /etc/ssh/sshd_config

Make the following changes to the file:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
Port 2222

Changing the default SSH port (e.g., to 2222) reduces noise from automated brute-force bots scanning port 22. After saving the file, restart the SSH service to apply the changes.

sudo systemctl restart sshd

Firewall and Network Security

A firewall controls incoming and outgoing network traffic based on predetermined security rules. Linux Mint includes Uncomplicated Firewall (UFW), a frontend for iptables that makes firewall management straightforward.

Configuring UFW

By default, UFW denies all incoming connections and allows all outgoing connections. Before enabling UFW, ensure you allow your custom SSH port so you don't lock yourself out.

sudo ufw allow 2222/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

Verify the status of your firewall to ensure the rules are applied correctly.

sudo ufw status verbose

Protecting Against Brute Force Attacks with Fail2Ban

Even with SSH keys and a custom port, attackers may attempt to brute-force other services. Fail2Ban monitors log files and temporarily bans IPs that show malicious signs, such as too many failed login attempts.

sudo apt install fail2ban -y
sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Fail2Ban works out of the box with default settings for SSH, but you can create a local configuration file to customize ban times and max retries.

File System and Process Hardening

Hardening the file system prevents malicious scripts from executing and limits the damage an attacker can do if they gain access to a specific service.

Securing Shared Memory

Shared memory (/run/shm) can be used in attacks against running services. You should secure it by mounting it with restrictive options like noexec, nosuid, and nodev.

Edit the fstab file:

sudo nano /etc/fstab

Add the following line at the bottom of the file:

tmpfs /run/shm tmpfs defaults,noexec,nosuid,nodev 0 0

Reboot the server or remount the partition to apply the changes:

sudo mount -o remount /run/shm

Disabling Unused Services

Linux Mint may start services that are unnecessary for a server environment, such as Bluetooth or printing services. Every running service is a potential attack vector. List all enabled services to identify what is running:

systemctl list-unit-files --type=service --state=enabled

Disable services you do not need. For example, to disable Bluetooth:

sudo systemctl disable bluetooth.service
sudo systemctl stop bluetooth.service

Best Practices for Ongoing Security

Securing a server is not a one-time task; it requires continuous vigilance. Follow these best practices to maintain a secure environment:

• Principle of Least Privilege: Only grant users and applications the permissions they absolutely need to function.
• Regular Audits: Periodically review user accounts, sudo logs, and firewall rules to ensure no unauthorized changes have been made.
• Monitor Logs: Use tools like logwatch or journalctl to monitor system logs for suspicious activity.
• Implement Backups: Maintain regular, encrypted, and off-site backups of your server data. A secure server is useless if data loss cannot be recovered.
• Use AppArmor: Ensure AppArmor (a Linux kernel security module) is enabled and enforcing policies for critical applications.

Conclusion

While Linux Mint is primarily designed for desktop use, its Ubuntu foundation makes it highly capable as a server when properly configured. By systematically applying this practical checklist—updating the system, enforcing strict SSH and user access controls, configuring a firewall, and hardening the file system—you significantly reduce your server's attack surface. Security is an ongoing process, and maintaining these configurations alongside regular monitoring will ensure your Linux Mint server remains robust and resilient against evolving threats.