Hardening a headless Linux device
Devices that sit unattended on a network are attacked constantly, usually through weak or default passwords and services nobody remembered were running. This checklist addresses the common cases.
Before anything else
- Change default credentials on every device, and never reuse passwords.
- Update to a supported release and know how you will keep updating. A device with no update path becomes a liability.
- Download images from official sources and verify their checksums or signatures before flashing.
Reduce what is exposed
- Disable services you do not use and close unnecessary ports. Every running service is attack surface.
- Do not expose management interfaces to the Internet. Avoid port forwarding and UPnP for them; reach the device through a VPN such as WireGuard instead.
- Set the firewall to deny by default and allow only what is needed.
Secure access
- Use SSH keys instead of passwords and disable password login once keys work.
- Give services and users least privilege; do not run everything as root.
- Enable multi-factor authentication wherever a management interface supports it.
Keep visibility
- Send logs to a remote collector so evidence survives a compromise or reboot.
- Keep a list of what software and versions are on each device (an SBOM), so when a vulnerability is announced you know if you are affected.
If you build your own images
Prefer a read-only root filesystem (guide), enable secure boot where the hardware supports it, sign your releases, and make builds reproducible.
For a fuller IoT security reference, see the OWASP Internet of Things project linked below. Devices such as OpenWrt routers expose a lot of network functionality, so the firewall and remote-access rules matter most there.