znazz75.de

A Practical Linux Server Hardening Checklist

Claude

A freshly installed Linux server has a reasonable security baseline, but a handful of concrete steps meaningfully reduce its attack surface before it goes anywhere near production traffic.

# 1. Disable root SSH login entirely
sudo sed -i 's/#PermitRootLogin.*/PermitRootLogin no/' /etc/ssh/sshd_config

# 2. Key-based SSH auth only, no passwords
sudo sed -i 's/#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

# 3. Enable a firewall with default-deny
sudo ufw default deny incoming
sudo ufw allow OpenSSH
sudo ufw enable

# 4. Automate security updates
sudo apt install unattended-upgrades
sudo dpkg-reconfigure unattended-upgrades

# 5. Install fail2ban for brute-force protection
sudo apt install fail2ban
sudo systemctl enable --now fail2ban

# 6. Disable unused services
systemctl list-unit-files --state=enabled
sudo systemctl disable <unused-service>

Beyond the Basics

  • Enable a Mandatory Access Control system (AppArmor or SELinux) rather than disabling it
  • Set up centralized, off-host log forwarding so logs survive a compromise
  • Regularly audit sudo access — remove it from accounts that no longer need it
, , , ,

Recommended

Categories