Linux Server Hardening Checklist

Every Linux server exposed to the internet needs proper hardening. This checklist covers the essential steps to secure your server against common attacks.

Step 1: Update Everything

sudo apt update && sudo apt upgrade -y
sudo apt autoremove -y

Enable automatic security updates:

sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

Step 2: Harden SSH

Edit /etc/ssh/sshd_config:

# Disable root login
PermitRootLogin no
Disable password authentication (use keys only)
PasswordAuthentication no
Change default port (optional but reduces noise)
Port 2222
Limit SSH to specific users
AllowUsers yourusername
Set idle timeout
ClientAliveInterval 300
ClientAliveCountMax 2
Disable X11 forwarding
X11Forwarding no

sudo systemctl restart sshd

Important: Make sure you have key-based access working BEFORE disabling passwords.

Step 3: Configure UFW Firewall

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 2222/tcp    # SSH (or 22 if using default port)
sudo ufw allow 80/tcp      # HTTP
sudo ufw allow 443/tcp     # HTTPS
sudo ufw enable
sudo ufw status verbose

Step 4: Install Fail2Ban

sudo apt install fail2ban
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Edit /etc/fail2ban/jail.local:

[sshd]
enabled = true
port = 2222
maxretry = 3
bantime = 3600
findtime = 600

sudo systemctl enable fail2ban
sudo systemctl start fail2ban
sudo fail2ban-client status sshd

Step 5: User Management

# Create a non-root user
sudo adduser deployer
sudo usermod -aG sudo deployer
Set strong password policy
sudo apt install libpam-pwquality

Edit /etc/security/pwquality.conf:

minlen = 12
dcredit = -1
ucredit = -1
ocredit = -1

Step 6: Disable Unnecessary Services

# List running services
sudo systemctl list-units --type=service --state=running
Disable what you don't need
sudo systemctl disable cups
sudo systemctl disable avahi-daemon
sudo systemctl disable bluetooth

Step 7: Set Up Audit Logging

sudo apt install auditd
sudo systemctl enable auditd
Monitor important files
sudo auditctl -w /etc/passwd -p wa -k user_changes
sudo auditctl -w /etc/shadow -p wa -k password_changes
sudo auditctl -w /etc/ssh/sshd_config -p wa -k ssh_config
View audit logs
sudo ausearch -k user_changes

Step 8: Configure File Permissions

# Secure critical files
chmod 600 /etc/shadow
chmod 644 /etc/passwd
chmod 700 /root
Find world-writable files
find / -type f -perm -o+w -not -path "/proc/" -not -path "/sys/" 2>/dev/null
Find SUID binaries
find / -perm -4000 -type f 2>/dev/null

Step 9: Set Up Log Monitoring

# Install logwatch for daily summaries
sudo apt install logwatch
sudo logwatch --detail High --mailto [email protected] --service All --range today

Quick Verification

# Check open ports
sudo ss -tulnp
Check failed login attempts
sudo journalctl -u sshd | grep "Failed"
Check fail2ban status
sudo fail2ban-client status
Review firewall rules
sudo ufw status numbered

Conclusion

These steps significantly reduce your attack surface. Security is ongoing — set up regular audits, keep systems updated, and monitor your logs. No server is "set and forget."