Security Strategies in Linux Platforms and Applications, 3rd Edition

Best Practices: Building and Maintaining a Secure Baseline

Ubuntu and other Linux distributions, including RHEL, Fedora Core, Rocky Linux, and others, will support the creation of a server baseline with a minimal installation. This will give you the smallest number of packages to start with and a good foundation on which you can then build other services, like a web server, a firewall, or a log server.

Additional options include read-only or live-bootable versions of Linux. Several directories may be suited to configuration as a read-only filesystem, subject to the changes required from functional and security-related updates. Alternatively, specialized mount options such as nosuid, nodev, and noexec can minimize risks to files in key directories. ...