Security Hardening

Lock down your WSL environment with firewall rules, SSH hardening, secrets management, and Windows Defender integration.

Firewall Rules for WSL

WSL 2 traffic passes through the Windows Firewall. You can control inbound and outbound access with standard firewall rules and the new Hyper-V firewall feature.

Enable WSL Firewall in .wslconfig

.wslconfig
[wsl2]
firewall=true
# Hyper-V firewall lets you write rules specifically for WSL traffic

Block Inbound Connections to WSL

PowerShell (Admin)
# Block all inbound traffic to WSL except SSH
PS>New-NetFirewallHyperVRule -Name "BlockWSLInbound" -Direction Inbound -Action Block -VMCreatorId '{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}'
# Allow SSH specifically
PS>New-NetFirewallHyperVRule -Name "AllowWSLSSH" -Direction Inbound -Action Allow -LocalPort 22 -Protocol TCP -VMCreatorId '{40E0AC32-46A5-438A-A0B2-2B479E8F2E90}'

Linux-side Firewall with UFW

Ubuntu (WSL)
# Install and enable UFW
user@wsl:~$ sudo apt install ufw
user@wsl:~$ sudo ufw default deny incoming
user@wsl:~$ sudo ufw default allow outgoing
user@wsl:~$ sudo ufw allow 22/tcp
user@wsl:~$ sudo ufw enable
Firewall is active and enabled on system startup

SSH Hardening

If you run an SSH server inside WSL for remote access, harden it beyond the defaults.

Generate Strong SSH Keys

Ubuntu (WSL)
# Generate an Ed25519 key (fast, secure, small)
user@wsl:~$ ssh-keygen -t ed25519 -C "your_email@example.com"
# Set correct permissions
user@wsl:~$ chmod 700 ~/.ssh && chmod 600 ~/.ssh/id_ed25519

Harden sshd_config

/etc/ssh/sshd_config
# Disable password authentication — use keys only
PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin no
MaxAuthTries 3
LoginGraceTime 30
# Only allow specific users
AllowUsers your_username
# Use a non-standard port to reduce noise
Port 2222
# Disable unused authentication methods
ChallengeResponseAuthentication no
UsePAM no
Ubuntu (WSL)
# Restart SSH to apply changes
user@wsl:~$ sudo service ssh restart
# Auto-start SSH when WSL boots
user@wsl:~$ echo '[boot]' | sudo tee -a /etc/wsl.conf
user@wsl:~$ echo 'command = service ssh start' | sudo tee -a /etc/wsl.conf

Secrets Management

Never store secrets in plain text inside WSL. Use credential helpers and environment isolation to keep tokens, API keys, and passwords safe.

Git Credential Manager

Use Windows Credential Manager from inside WSL so tokens are stored in the encrypted Windows vault.

Ubuntu (WSL)
# Use Git Credential Manager from Windows
user@wsl:~$ git config --global credential.helper /mnt/c/Program\\ Files/Git/mingw64/bin/git-credential-manager.exe

Environment Variable Isolation

Prevent Windows environment variables from leaking into WSL by controlling the WSLENV variable and the interop settings.

/etc/wsl.conf
[interop]
enabled = true
appendWindowsPath = false
# Only expose specific Windows paths you need

SSH Agent Forwarding

Share your Windows SSH keys with WSL securely using 1Password, the Windows SSH agent, or keychain.

Ubuntu (WSL)
# Install keychain for persistent SSH agent
user@wsl:~$ sudo apt install keychain
# Add to your .bashrc
user@wsl:~$ echo 'eval $(keychain --eval --agents ssh id_ed25519)' >> ~/.bashrc

Windows Defender & WSL

Windows Defender can scan WSL file systems, but this can slow down build processes. Balance security with performance using targeted exclusions.

Add Performance Exclusions

PowerShell (Admin)
# Exclude WSL virtual disk from real-time scanning
PS>Add-MpPreference -ExclusionPath "$env:LOCALAPPDATA\Packages\CanonicalGroupLimited*"
# Exclude common build tool processes
PS>Add-MpPreference -ExclusionProcess "node.exe", "python3", "cargo", "rustc"

Security trade-off: Only add exclusions for build directories you trust. Never exclude your entire WSL filesystem — keep Defender scanning downloads and untrusted files.

Enable Microsoft Defender for Linux (Enterprise)

For enterprise environments, Microsoft Defender for Endpoint can run inside WSL to provide real-time protection within the Linux filesystem.

Ubuntu (WSL)
# Install Microsoft Defender for Endpoint (requires enterprise license)
user@wsl:~$ curl -o microsoft.list https://packages.microsoft.com/config/ubuntu/$(lsb_release -rs)/prod.list
user@wsl:~$ sudo mv microsoft.list /etc/apt/sources.list.d/
user@wsl:~$ sudo apt update && sudo apt install mdatp
# Verify status
user@wsl:~$ mdatp health --field healthy
true

Security Checklist

Quick reference for hardening a fresh WSL installation.

Keep Windows and WSL kernel updated (wsl --update)

Disable password authentication for SSH — use key-based auth

Set appendWindowsPath = false to limit path exposure

Use Git Credential Manager instead of storing tokens in dotfiles

Enable firewall=true in .wslconfig

Add Defender exclusions only for trusted build directories

Run regular package updates: sudo apt update && sudo apt upgrade

Audit open ports: ss -tlnp inside WSL

Use separate WSL distros for different trust levels

Next Steps

Networking Deep Dive

Configure networking modes and port forwarding securely.

Enterprise Playbook

Governance, compliance, and rollout strategies for enterprise WSL.

Best Practices

General tips for keeping your WSL environment clean and efficient.

Troubleshooting

Fix common security-related issues and permission errors.