Linux Server Hardening: The Complete Checklist

Why Server Hardening Matters

A default Linux installation is not secure. Out of the box, servers have unnecessary services running, weak defaults, and missing security configurations. Hardening reduces the attack surface and makes it significantly harder for attackers to compromise your system.

SSH Hardening

SSH is the primary way you access your server, making it the #1 target for attackers.

Disable Root Login

# /etc/ssh/sshd_config
PermitRootLogin no

Use Key-Based Authentication

# Generate a key pair on your local machine
ssh-keygen -t ed25519 -C "[email protected]"

# Copy to server
ssh-copy-id user@your-server

# Disable password authentication
# /etc/ssh/sshd_config
PasswordAuthentication no
PubkeyAuthentication yes

Change Default Port

# /etc/ssh/sshd_config
Port 2222

# Don't forget to update your firewall
sudo ufw allow 2222/tcp

Set Idle Timeout

# /etc/ssh/sshd_config
ClientAliveInterval 300
ClientAliveCountMax 2

Firewall Configuration

UFW (Uncomplicated Firewall)

# Enable UFW
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow only necessary ports
sudo ufw allow 2222/tcp   # SSH (custom port)
sudo ufw allow 80/tcp     # HTTP
sudo ufw allow 443/tcp    # HTTPS

# Enable
sudo ufw enable

Automatic Security Updates

# Install unattended-upgrades
sudo apt install unattended-upgrades

# Configure
sudo dpkg-reconfigure -plow unattended-upgrades

Fail2Ban Setup

sudo apt install fail2ban

# Create local config
sudo cat > /etc/fail2ban/jail.local << 'EOF'
[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 3

[sshd]
enabled = true
port = 2222
EOF

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

File Permissions

# Secure SSH directory
chmod 700 ~/.ssh
chmod 600 ~/.ssh/authorized_keys

# Secure sensitive config files
chmod 600 /etc/ssh/sshd_config
chmod 644 /etc/passwd
chmod 640 /etc/shadow

Disable Unnecessary Services

# List running services
systemctl list-units --type=service --state=running

# Disable unnecessary ones
sudo systemctl disable cups
sudo systemctl disable avahi-daemon
sudo systemctl disable bluetooth

Kernel Security (sysctl)

# /etc/sysctl.d/99-security.conf
net.ipv4.tcp_syncookies = 1
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
kernel.randomize_va_space = 2

# Apply
sudo sysctl -p /etc/sysctl.d/99-security.conf

Monitoring with ServerGuard

After hardening, monitor your server to ensure security stays intact:

• Security score — ServerGuard checks a set of common hardening items and gives you a score
• File integrity monitoring — Compare critical files against a baseline when you run a check
• Login monitoring — Track SSH failures; repeated failures raise an incident
• Vulnerability scanning — Package exposure scans, on request
• ClamAV integration — Malware scans you start from the console

The Complete Checklist

• [ ] Disable root SSH login
• [ ] Use SSH keys instead of passwords
• [ ] Change SSH port
• [ ] Configure UFW firewall
• [ ] Install and configure Fail2Ban
• [ ] Enable automatic security updates
• [ ] Disable unnecessary services
• [ ] Apply kernel security parameters
• [ ] Set proper file permissions
• [ ] Install monitoring agent
• [ ] Configure alerting
• [ ] Schedule regular security scans

Conclusion

Server hardening is not a one-time task. It's an ongoing process of maintaining security posture as new vulnerabilities are discovered and your infrastructure evolves. Use this checklist as a starting point, and implement continuous monitoring to ensure your hardening stays effective.