Linux Server Hardening for CentOS 5 and CentOS 6.2

Introduction

Server security is one of the most critical responsibilities of a Linux administrator. CentOS 5 and CentOS 6.2 systems are now considered legacy operating systems and no longer receive official security updates. As a result, these servers are more vulnerable to modern cyber threats, including brute-force attacks, privilege escalation, malware infections, rootkits, and denial-of-service attacks.

While upgrading to a supported operating system is strongly recommended, organizations may still maintain older CentOS servers for legacy applications. In such environments, implementing additional security controls becomes essential to reduce risks and improve system stability.

This guide covers several important hardening techniques, including process monitoring, temporary directory protection, SSH security improvements, rootkit detection tools, and firewall configuration. These measures help strengthen server security and provide better visibility into suspicious activities.

Linux Server Hardening for CentOS 5 and CentOS 6.2

1. Install SPRI (Priority Scheduler)

SPRI helps optimize process scheduling and improves overall server performance by prioritizing critical system processes.

Installation

cd /root/
wget http://www.rfxn.com/downloads/spri-current.tar.gz

tar xvfz spri-*.tar.gz
cd spri-*

./install.sh

spri -v

Benefits

• Improves CPU resource allocation
• Prioritizes critical services
• Helps maintain system responsiveness during high load

2. Install PRM (Process Resource Monitor)

PRM monitors server processes and automatically kills resource-abusing applications.

Installation

cd /root

wget http://www.rfxn.com/downloads/prm-current.tar.gz

tar xvfz prm-*.tar.gz
cd prm-*

./install.sh

prm -j

Benefits

• Prevents CPU abuse
• Controls excessive memory consumption
• Protects against runaway processes

3. Temporary Directory Hardening

The /tmp directory is commonly targeted by attackers to execute malicious scripts. Mounting /tmp with noexec and nosuid options significantly improves security.

Backup Existing Configuration

cp /etc/fstab /etc/fstab.bak

Verify whether a dedicated /tmp partition already exists:

df -h

Create Dedicated /tmp Partition

cd /usr

dd if=/dev/zero of=/usr/tmpMnt bs=1024 count=2000000

mke2fs -j /usr/tmpMnt

Backup current temporary files:

cd /

cp -R /tmp /tmp_backup

Mount secured partition:

mount -o loop,noexec,nosuid,rw /usr/tmpMnt /tmp

chmod 0777 /tmp

cp -R /tmp_backup/* /tmp/

rm -rf /tmp_backup

Configure Automatic Mount

Edit /etc/fstab:

nano -w /etc/fstab

Add:

/usr/tmpMnt /tmp ext3 loop,noexec,nosuid,rw 0 0

Mount the partition:

mount /tmp

Secure /var/tmp

Replace /var/tmp with a symbolic link:

rm -rf /var/tmp
ln -s /tmp /var/tmp

If /var/tmp is a separate partition, apply the same hardening options:

loop,noexec,nosuid,rw

Benefits

• Prevents execution of malicious files
• Blocks SUID privilege escalation attacks
• Reduces exploitation opportunities

4. SSH Server Hardening

SSH is one of the most targeted services on Linux servers. Proper configuration helps prevent brute-force attacks and unauthorized access.

Modify SSH Configuration

nano -w /etc/ssh/sshd_config

Locate:

#Protocol 2,1

Change to:

Protocol 2

Append:

LoginGraceTime 120
IgnoreRhosts yes
X11Forwarding no

Restart SSH:

service sshd restart

Disable Direct Root Login

Create Administrative User

groupadd anyuser123

useradd anyuser123 -g anyuser123

passwd anyuser123

Assign a password when prompted.

Add User to Wheel Group

Edit:

nano -w /etc/group

Locate:

wheel:x:10:root

Change to:

wheel:x:10:root,anyuser123

Disable Root SSH Login

Edit SSH configuration:

nano -w /etc/ssh/sshd_config

Modify:

PermitRootLogin no

Add:

AllowUsers anyuser123

Restart SSH:

service sshd restart

Benefits

• Prevents direct root access
• Reduces brute-force attack surface
• Improves account auditing

5. Install ChkRootKit

ChkRootKit scans the server for known rootkits and suspicious modifications.

Installation

cd /root/

wget ftp://ftp.pangeia.com.br/pub/seg/pac/chkrootkit.tar.gz

mv chkrootkit.tar.gz /usr/local/src/

cd /usr/local/src/

tar -zxf chkrootkit.tar.gz

cd chkrootkit*

make sense

cd /root

mv /usr/local/src/chkrootkit* /usr/local/chkrootkit

Configure Weekly Scan

Create:

nano /etc/cron.weekly/chkrootkit.sh

Add:

#!/bin/bash

EMAIL=your@domain.com

/usr/local/chkrootkit/chkrootkit -q | \
mail -s "ChkRootKit Scan Report - $(hostname)" $EMAIL

Set permissions:

chmod 755 /etc/cron.weekly/chkrootkit.sh

Benefits

• Detects common rootkits
• Provides scheduled security reports
• Helps identify compromised systems

6. Install RKHunter

RKHunter (Rootkit Hunter) performs comprehensive system scans for rootkits, hidden files, and suspicious configurations.

Installation

cd /root

wget http://space.dl.sourceforge.net/project/rkhunter/rkhunter/1.3.8/rkhunter-1.3.8.tar.gz

tar -zxf rkhunter-1.3.8.tar.gz

cd rkhunter*

./installer.sh --layout default --install

Configure Weekly Scan

Create:

nano /etc/cron.weekly/rkhunter.sh

Add:

#!/bin/bash

EMAIL=your@domain.com

rkhunter -c --sk --summary -q | \
mail -s "RKHunter Scan Report - $(hostname)" $EMAIL

Set permissions:

chmod 755 /etc/cron.weekly/rkhunter.sh

Benefits

• Detects rootkits and backdoors
• Monitors system binaries
• Identifies suspicious changes

7. Install CSF Firewall

ConfigServer Security & Firewall (CSF) is one of the most widely used Linux firewalls for server protection.

Installation

cd /root

wget http://www.configserver.com/free/csf.tgz

tar -xzf csf.tgz

cd csf

sh install.sh

Verify Required iptables Modules

perl /etc/csf/csftest.pl

Expected result:

RESULT: csf should function on this server

Benefits

• Stateful packet filtering
• Brute-force attack protection
• Login Failure Daemon (LFD)
• Easy firewall management

Additional Hardening Recommendations

Although the above steps improve security, consider implementing the following best practices:

Keep Packages Updated

yum update -y

Disable Unused Services

chkconfig --list
service <service_name> stop
chkconfig <service_name> off

Enable Log Monitoring

Monitor:

/var/log/messages
/var/log/secure
/var/log/maillog

Enforce Strong Password Policies

Install password quality controls and require:

• Minimum 12 characters
• Uppercase letters
• Lowercase letters
• Numbers
• Special characters

Configure Automatic Backups

Maintain:

• Daily backups
• Weekly full backups
• Offsite backup copies

Enable Intrusion Detection

Consider:

• OSSEC
• AIDE
• Fail2Ban

Security Verification Checklist

Conclusion

Hardening a Linux server is a continuous process rather than a one-time task. Legacy operating systems such as CentOS 5 and CentOS 6.2 require additional attention because they no longer receive vendor security updates. By implementing process monitoring tools like SPRI and PRM, securing temporary directories, hardening SSH access, deploying rootkit detection utilities, and configuring a firewall, administrators can significantly reduce the attack surface of their servers.

While these measures improve security, the most effective long-term solution is to migrate legacy workloads to a supported operating system such as AlmaLinux, Rocky Linux, or a modern Enterprise Linux distribution. Combining proper hardening, continuous monitoring, regular patching, and proactive security audits will help maintain a secure and reliable server environment.