Linux hardening

Incorrect — a speed bump; against keys-only it is nearly pointless.

Incorrect — security by obscurity; bots still find it.

Incorrect — cosmetic, no real protection.

Incorrect — not the reason.

Incorrect — it forces attribution, not brute-force immunity.

Incorrect — unrelated.

Incorrect — unnecessary and risky if the config is broken.

Incorrect — never.

Incorrect — unrelated and dangerous.

Incorrect — too small and outdated.

Incorrect — deprecated and weak.

Incorrect — a password is not a key.

Incorrect — then a server compromise leaks your login everywhere.

Incorrect — never commit a private key.

Incorrect — world-writable and wrong.

Incorrect — not the point.

Incorrect — it is not a password store.

Incorrect — SSH already encrypts; the bastion is about surface.

Incorrect — that is nftables.

Incorrect — that is sysctl.

Incorrect — that is AIDE.

Incorrect — that is crypt/shadow.

Incorrect — no.

Incorrect — that is ssh-keygen.

Incorrect — not the issue.

Incorrect — not the issue.

Incorrect — irrelevant.

Incorrect — that is passwordless root.

Incorrect — wildcards widen the grant beyond intent.

Incorrect — exactly what to avoid.

Incorrect — that fails open — the opposite of hardening.

Incorrect — leaves everything exposed.

Incorrect — that is backwards and blocks your own access.

Incorrect — no — default-deny drops it.

Incorrect — firewalls do not encrypt.

Incorrect — unrelated.

Incorrect — maximizes exposure.

Incorrect — then you cannot manage the host.

Incorrect — SSH is TCP.

Incorrect — it can cut you off instantly.

Incorrect — unrelated.

Incorrect — unrelated.

Incorrect — not a performance setting.

Incorrect — that is a different concern.

Incorrect — it does not stop scanning.

Incorrect — that is tcp_syncookies.

Incorrect — unrelated.

Incorrect — not a redirect concern.

Incorrect — no.

Incorrect — unrelated.

Incorrect — unrelated.

Incorrect — helps, but the service still runs.

Incorrect — does not remove the surface.

Incorrect — the opposite of hardening.

Incorrect — exposes it on all interfaces.

Incorrect — maximizes exposure.

Incorrect — still public.

Incorrect — it reduces real attack surface and post-exploitation tooling.

Incorrect — it does not.

Incorrect — it applies to hosts too.

Incorrect — unrelated to ptrace.

Incorrect — that is a firewall/sysctl-net concern.

Incorrect — unrelated.

Incorrect — those are network settings.

Incorrect — they do not block execution.

Incorrect — unrelated.

Incorrect — no.

Incorrect — no.

Incorrect — not generally.

Incorrect — no.

Incorrect — unrelated.

Incorrect — unrelated.

Incorrect — not the reason.

Incorrect — not the concern.

Incorrect — irrelevant.

Incorrect — the opposite.

Incorrect — no.

Incorrect — it prevents loading, not deletion.

Incorrect — trivial compared to the real risk.

Incorrect — the danger is that it is not.

Incorrect — it has full kernel control.

Incorrect — they can write; noexec stops execution.

Incorrect — noexec is about execution, not reading.

Incorrect — the opposite.

Incorrect — that is read-only.

Incorrect — that is nodev.

Incorrect — that is noexec.

Incorrect — unrelated.

Incorrect — unrelated.

Incorrect — unrelated.

Incorrect — that is discretionary permissions.

Incorrect — it applies to all processes.

Incorrect — different layer entirely.

Incorrect — that would say Disabled.

Incorrect — that is Permissive.

Incorrect — unrelated to SELinux mode.

Incorrect — MAC is not encryption.

Incorrect — the opposite.

Incorrect — that is the firewall.

Incorrect — that disables a whole defensive layer.

Incorrect — never disable it to fix one denial.

Incorrect — not a fix.

Incorrect — no.

Incorrect — it logs, it does not fail silently.

Incorrect — different subsystem.

Incorrect — that is SELinux’s model.

Incorrect — no.

Incorrect — that is integrity monitoring.

Incorrect — an unproven profile breaks the app.

Incorrect — that removes confinement.

Incorrect — unrelated.

Incorrect — that is the right fix.

Incorrect — that is correct.

Incorrect — that is correct.

Incorrect — less critical than exposed ones.

Incorrect — not the MAC target.

Incorrect — those are protected differently.

Incorrect — neither is those OSes.

Incorrect — AppArmor is Debian-family; SELinux is not.

Incorrect — they harden hosts too.

Incorrect — the point is it is independent of the app.

Incorrect — different purpose.

Incorrect — it logs syscalls and file access broadly.

Incorrect — p wa is write + attribute, not read.

Incorrect — that would be p x.

Incorrect — it covers writes and attribute changes.

Incorrect — size is irrelevant.

Incorrect — no.

Incorrect — no.

Incorrect — they load, then lock.

Incorrect — no.

Incorrect — no.

Incorrect — the opposite in practice.

Incorrect — it produces too many, not none.

Incorrect — noise slows investigation.

Incorrect — it detects, it does not block.

Incorrect — no.

Incorrect — that is a port scanner.

Incorrect — too late — you would baseline the attacker.

Incorrect — no.

Incorrect — update it deliberately after approved changes.

Incorrect — no — a consensus hardening checklist.

Incorrect — no.

Incorrect — no.

Incorrect — hosts drift after one scan.

Incorrect — you need the scan to know what to fix.

Incorrect — that hides the problem.

Incorrect — no — benchmarks check config, not app vulns or an attacker inside.

Incorrect — overstated.

Incorrect — patching is still essential.