Securing Void Linux Servers: A Practical Checklist

Introduction to Securing Void Linux Servers

Void Linux is a lightweight, independent, and highly customizable Linux distribution known for its use of the runit init system and the XBPS package manager. Because it does not rely on systemd, securing a Void Linux server requires a slightly different approach compared to mainstream distributions like Ubuntu or CentOS. This tutorial provides a practical checklist for securing a Void Linux server, covering everything from initial updates to firewall configuration and mandatory access control.

Securing any server is critical because default installations are designed for ease of use rather than maximum security. Exposed servers are constantly scanned and targeted by automated bots and malicious actors. By following this checklist, you will significantly reduce your server's attack surface, protect sensitive data, and ensure system stability.

Initial System Setup and Updates

The first step in securing your Void Linux server is ensuring that all installed software is up to date and that unnecessary services are disabled. Void Linux uses the X Binary Package System (XBPS) for package management.

Keeping the System Updated

Regularly updating your system patches known vulnerabilities. You should perform this immediately after installation and schedule it as a routine maintenance task.

sudo xbps-install -Su

If the kernel is updated, you will need to reboot the server to apply the changes. You can check your current kernel version and the installed version using:

uname -r
xbps-query -S linux

Managing Services with runit

Void Linux uses runit as its init system. Services are managed by creating symbolic links in the /var/service directory. To secure your server, you must ensure that only necessary services are running.

To list all enabled services, check the /var/service directory:

ls -l /var/service

If you find a service you do not need, such as a default printing service or an unused database, disable it by removing the symlink:
sudo rm /var/service/unnecessary-service

Always verify that disabling a service does not break critical system functionality before removing it.

Securing User Access and SSH
Remote administration is typically done via SSH. Securing the SSH daemon is one of the most effective ways to protect your server from unauthorized access.

Configuring SSH
Edit the SSH daemon configuration file located at /etc/ssh/sshd_config. You should enforce key-based authentication and disable root login over SSH.
sudo nano /etc/ssh/sshd_config

Modify or add the following lines to the configuration file:
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
Port 2222

Changing the default SSH port (e.g., to 2222) helps reduce noise from automated brute-force scripts, though it is not a substitute for strong authentication. After saving the file, restart the SSH service using runit:
sudo sv restart sshd

Ensure you have set up SSH keys for your non-root user and verified that you can log in before closing your current session.

Implementing Fail2ban
To further protect your SSH server, install and configure Fail2ban. This tool monitors log files and temporarily bans IP addresses that show malicious signs, such as too many failed login attempts.
sudo xbps-install fail2ban

Enable and start the Fail2ban service using runit:
sudo ln -s /etc/sv/fail2ban /var/service/

You can configure Fail2ban by creating a local configuration file at /etc/fail2ban/jail.local to override default settings, such as ban time and find time.

Firewall Configuration
A firewall controls incoming and outgoing network traffic based on predetermined security rules. Void Linux supports nftables, the modern successor to iptables, as its primary firewall framework.

Using nftables
Install the nftables package:
sudo xbps-install nftables

Create a basic firewall configuration file at /etc/nftables.conf. The following configuration allows loopback traffic, established connections, and incoming SSH (on port 2222), while dropping all other incoming traffic.
#!/usr/sbin/nft -f

flush ruleset

table inet filter {
    chain input {
        type filter hook input priority 0; policy drop;
        
        # Allow loopback traffic
        iif "lo" accept
        
        # Allow established connections
        ct state established, related accept
        
        # Allow SSH on custom port
        tcp dport 2222 accept
        
        # Allow ICMP (ping)
        ip protocol icmp accept
        ip6 nexthdr icmpv6 accept
    }
    
    chain forward {
        type filter hook forward priority 0; policy drop;
    }
    
    chain output {
        type filter hook output priority 0; policy accept;
    }
}

Apply the configuration and enable the service to start on boot:
sudo nft -f /etc/nftables.conf
sudo ln -s /etc/sv/nftables /var/service/


Application Hardening and Best Practices
Beyond basic network and access controls, applying system-level hardening mechanisms provides defense-in-depth.

AppArmor Integration
AppArmor is a Linux kernel security module that allows the system administrator to restrict programs' capabilities with per-program profiles. Void Linux provides AppArmor support out of the box.
Install the required packages:
sudo xbps-install apparmor apparmor-utils

Enable AppArmor by adding the necessary parameters to your kernel command line. If you are using GRUB, edit /etc/default/grub and append apparmor=1 security=apparmor to the GRUB_CMDLINE_LINUX_DEFAULT variable:
GRUB_CMDLINE_LINUX_DEFAULT="loglevel=4 apparmor=1 security=apparmor"

Update GRUB and reboot:
sudo update-grub
sudo reboot

Verify that AppArmor is running after the reboot:
sudo aa-status


Principle of Least Privilege
Always adhere to the principle of least privilege. Avoid running applications as the root user. Instead, create dedicated system users for specific services.

    
Create a service user with no login shell: sudo useradd -r -s /usr/bin/nologin myservice
    
Use sudo for administrative tasks and configure it to require a password.
    
Regularly audit file permissions, especially for configuration files containing secrets, using chmod and chown.


Conclusion
Securing a Void Linux server requires a methodical approach that leverages its unique tools like XBPS, runit, and nftables. By keeping your system updated, locking down SSH access, implementing a strict firewall, and enabling Mandatory Access Control via AppArmor, you build a robust defense against common threats. Security is not a one-time setup but an ongoing process; you must continuously monitor your logs, audit your services, and apply updates to maintain a hardened server environment. By following this practical checklist, you can confidently deploy Void Linux in production while minimizing your attack surface.