Linux Server Security Hardening: 15 Essential Steps Every Admin Must Know

Why Server Hardening is Non-Negotiable

The average newly deployed Linux server is scanned by automated bots within minutes of receiving a public IP address. Without proper hardening, these bots will attempt brute-force attacks, exploit known vulnerabilities, and attempt to install malware or cryptocurrency miners. Server hardening is the process of reducing your attack surface — closing unnecessary doors before attackers can find them.

Step 1: Update Everything Immediately

apt update && apt upgrade -y && apt autoremove -y

Many attacks exploit known vulnerabilities in outdated packages. Running updates immediately after provisioning closes hundreds of potential vulnerabilities. Configure automatic security updates with unattended-upgrades.

Step 2: Create a Non-Root User

adduser yourname
usermod -aG sudo yourname

Never operate as root. Create a dedicated user with sudo privileges for administrative tasks. This limits the blast radius of any compromised session.

Step 3: SSH Key Authentication

Passwords can be brute-forced. SSH keys cannot (practically). Generate a key pair on your local machine:

ssh-keygen -t ed25519 -C "your-email@example.com"

Copy the public key to your server with ssh-copy-id, then disable password authentication in /etc/ssh/sshd_config: set PasswordAuthentication no.

Step 4: Disable Root SSH Login

In /etc/ssh/sshd_config, set: PermitRootLogin no. Restart SSH: systemctl restart sshd. Attackers almost always try root first — removing it as an option eliminates a major attack vector.

Step 5: Change the Default SSH Port

Port 22 receives millions of automated attack attempts daily. Moving SSH to a non-standard port (e.g., 2222 or higher) eliminates the vast majority of automated scanning bots.

Step 6: Configure UFW Firewall

ufw default deny incoming
ufw default allow outgoing
ufw allow 2222/tcp  # your SSH port
ufw allow 80/tcp
ufw allow 443/tcp
ufw enable

Step 7: Install and Configure Fail2Ban

Fail2Ban monitors log files and automatically bans IPs that show malicious behavior like multiple failed login attempts:

apt install fail2ban -y
systemctl enable fail2ban

Step 8: Disable Unused Services

Every running service is a potential attack surface. List all running services with systemctl list-units --type=service --state=running and disable any you don't need.

Step 9: Configure Automatic Security Updates

apt install unattended-upgrades -y
dpkg-reconfigure --priority=low unattended-upgrades

Step 10: Enable Audit Logging

The auditd daemon provides comprehensive system call auditing, allowing you to track who did what on your server and detect suspicious activity.

FAQ

How often should I review server security?

Run a security audit at minimum monthly. Check logs weekly. Review installed packages and running services whenever you make configuration changes.

Is UFW sufficient for server protection?

UFW is a good baseline but should be combined with Fail2Ban, intrusion detection (like OSSEC or Wazuh), and DDoS protection at the network level for comprehensive defense.