Linux Server Administration: Hardening and Performance Tuning for Production

Why Linux Dominates Enterprise Infrastructure

Linux powers over 90 % of public cloud workloads, the majority of web servers, and most enterprise database deployments. Its flexibility, performance, and open-source ecosystem make it the default choice for production infrastructure.

But a default Linux installation is not production-ready. This guide covers the essential hardening and tuning steps.

Security Hardening

User & Access Control

• Disable root SSH login
• Enforce SSH key-based authentication; disable password auth
• Implement sudo with least-privilege principles
• Use fail2ban or similar tools to block brute-force attempts

Firewall Configuration

• Use nftables or iptables to allow only necessary inbound ports
• Default policy: deny all inbound, allow all outbound
• Rate-limit SSH connections to prevent enumeration attacks
• Enable connection tracking for stateful inspection

Patch Management

• Subscribe to your distribution's security mailing list
• Automate security patches with unattended-upgrades (Debian/Ubuntu) or dnf-automatic (RHEL/Fedora)
• Schedule kernel updates with planned maintenance windows

File System Security

• Mount /tmp with noexec, nosuid, nodev options
• Enable auditing with auditd for critical file changes
• Use SELinux or AppArmor in enforcing mode—not permissive

Performance Tuning

Kernel Parameters

Key sysctl tunings for high-traffic servers:

• Increase socket backlog for high connection counts
• Handle SYN floods gracefully with increased backlog
• Prefer RAM over swap for database workloads (low swappiness)
• Raise file descriptor limits for large-scale applications

I/O Scheduler

• Use none or mq-deadline for NVMe/SSD storage
• Use bfq for mixed workloads on rotational storage

Process Limits

Raise nofile and nproc limits to ensure sufficient process and file descriptor limits for multi-threaded enterprise applications.

Monitoring

• Deploy node_exporter + Prometheus + Grafana for real-time system metrics
• Alert on: CPU > 85 % for 5+ minutes, disk usage > 90 %, OOM killer invocations
• Use journalctl and centralised log aggregation for troubleshooting

Automation

Codify all hardening and tuning as Infrastructure-as-Code (Ansible, Terraform) so every new server is consistent, auditable, and reproducible.