The Linux kernel now fixes over 1,500 CVEs per major version, and projections for Linux 7.3 approach 2,000 CVEs per release. This inflation, driven by AI-assisted code analysis tools, radically changes the game for system administrators. Protecting a Linux system is no longer just about enabling a firewall and running a weekly apt upgrade: it is a task of sorting, prioritizing, and continuous defensive architecture.
Triage of Linux Kernel CVEs: Managing the Patch Avalanche
Between kernel versions 6.9 and 6.19, the pace was around 500 CVEs fixed per release. Since Linux 7.0, this volume has doubled, then tripled. The maintainers themselves report being “completely overwhelmed” by the flow of reports generated via automated tools.
For an administrator, this means that systematically patching every CVE has become unrealistic without prioritization tools. Applying all patches blindly means continuously restarting services, with a risk of functional regression on production loads.
A raw CVSS score of 7.5 on a network vulnerability does not have the same impact on a server isolated behind a private network as it does on a machine exposed in a DMZ. A contextual CVSS score approach allows for prioritizing truly critical patches.
Tools like KernelCare (live patching without rebooting) or the OVAL feeds provided by distributions filter the CVEs applicable to your actual configuration. The resources dedicated to security on Hebdo Linux usefully complement this technical monitoring.
SSH Configuration and Privileged Access Control on Linux
SSH remains the most targeted attack vector on exposed Linux servers. The default configuration of OpenSSH on most distributions is functional, not secure.
sshd_config Parameters to Lock Down First
- PermitRootLogin no and disabling password authentication (PasswordAuthentication no): only Ed25519 or ECDSA key authentication should be allowed on a production server
- Restricting encryption algorithms to modern suites via KexAlgorithms and Ciphers, explicitly excluding diffie-hellman-group1-sha1 and CBC
- Enabling AllowUsers or AllowGroups to limit SSH access to a named list of accounts, rather than relying solely on the firewall
- Setting MaxAuthTries to 3 and reducing LoginGraceTime to 30 seconds to limit the brute-force window
Managing Privilege Escalation with sudo
The sudoers configuration deserves as much attention as SSH. A too-permissive sudoers file nullifies any least privilege policy. We still regularly observe configurations where an application account has ALL=(ALL) NOPASSWD: ALL, effectively granting it permanent root access.
The best practice is to create targeted command aliases (Cmnd_Alias) for each application role and to log each sudo invocation via syslog. Coupled with auditd, this provides complete traceability of privileged actions.
Reducing the Network Attack Surface on a Linux Server
Every open port and every active service represents a potential entry point. Reducing the attack surface starts with a rigorous inventory.
The command ss -tulnp (which replaces netstat) lists listening sockets with the associated process. On a typical web server, only ports 22, 80, and 443 should appear. Any additional service (postfix, cups, avahi-daemon, rpcbind) should be disabled via systemctl disable if not required, then masked with systemctl mask to prevent accidental reactivation.
For network filtering, nftables has replaced iptables as the default framework on recent kernels. Its declarative syntax using sets and maps simplifies large-scale rule management. A default drop policy on the input and forward chains, with explicit opening of necessary flows, remains the foundation.
Audit and Logging: auditd, journald, and Linux Intrusion Detection
Without centralized logging, any compromise remains invisible until damage is observed. The Linux kernel’s audit framework (auditd) allows monitoring of critical system calls with fine granularity.
The rules to prioritize for configuration concern monitoring changes to /etc/passwd, /etc/shadow, /etc/sudoers, and SSH configuration files. An auditctl rule like -w /etc/shadow -p wa -k shadow_changes logs any write or attribute modification on the file.
For file-level intrusion detection, AIDE (Advanced Intrusion Detection Environment) generates a cryptographic fingerprint of the system tree. Any unauthorized modification of a binary or configuration file triggers an alert during the next scan. A daily scan via cron with report delivery over an encrypted channel constitutes a viable minimum.
Journald, coupled with remote aggregation (via systemd-journal-remote or a collector like rsyslog to a SIEM), allows for correlating events across multiple servers. An attacker who compromises a machine will attempt to purge local logs. Sending logs to a third-party server makes this purge ineffective.
Cyber Resilience Act and Linux System Compliance in Europe
The Cyber Resilience Act (CRA) imposes obligations on software vendors, including those integrating open-source components, to track vulnerabilities and provide patches throughout the product’s lifecycle. The first reporting obligations come into effect in September 2026.
For teams deploying Linux in a professional environment, the CRA means that traceability of components (SBOM, Software Bill of Materials) and the ability to demonstrate a patch management process become regulatory requirements, not just best practices. Major distributions have begun providing actionable SBOMs, but the responsibility for compliance remains with the entity bringing the product to the European market.
The combination of a kernel generating nearly 2,000 CVEs per release and a regulatory framework requiring documented management of each vulnerability makes live patching and triage automation tools no longer optional, but structurally necessary for any Linux infrastructure in production.
