How-To: Hardening a New Linux Server

Every new server I stand up gets the same basic treatment before it does anything else. Here’s the checklist.

1. Update everything and turn on automatic security updates (unattended-upgrades on Debian/Ubuntu, dnf-automatic on RHEL-family).
2. Create a normal user with sudo and stop working as root.
3. SSH keys only. In sshd_config, set PasswordAuthentication no and PermitRootLogin no. Test a second session before you log out.
4. Firewall: default deny inbound, then allow only what you need (ufw or firewalld).
5. fail2ban to block brute-force attempts.
6. Remove what you don’t use. Check listening ports with ss -tulpn and disable stray services.
7. Time sync and logging so your logs actually line up when you need them.
8. Backups, and test a restore at least once.
9. Patch the kernel and reboot when security fixes land. Bugs like this week’s PwnEscape are why.

None of this is fancy, but it stops the vast majority of drive-by attacks.

Happy Hacking!

References & Further Reading

• sshd_config manual
• fail2ban
• ArchWiki: Security
• CIS Benchmarks