Advertisement
linuxserver • Learn how to harden your Linux server with practical security steps like SSH security, firewalls, updates, user permissions, intrusion protection, and backups. A beginner-friendly and realistic guide.

Linux Server Hardening Guide: Simple Security Steps Every Admin Should Do

5 Min Read Verified Content

If you run a Linux server on the internet, you quickly learn one simple truth:

👉 Someone, somewhere, is always trying to break into it.

Even if your server is tiny. Even if it’s just a test site. Bots don’t care — they scan everything.

That’s why Linux hardening matters.
Not because we want to be paranoid — but because security is about reducing risk, layer by layer.

In this guide, I’ll walk through the core security steps I personally apply on new servers. Nothing extreme. Nothing complicated. Just practical protection you can actually maintain.

🔐 Step 1 — Secure SSH Access (Your Server’s Front Door)

SSH is the main target for brute-force attacks.

Here’s what I always do:

✔ Disable root login

Edit:

sudo nano /etc/ssh/sshd_config

Set:

PermitRootLogin no

Root access should require sudo — not direct login.

✔ Use SSH keys instead of passwords

Generate a key on your local machine:

ssh-keygen

Copy it:

ssh-copy-id user@server

Then disable password login:

PasswordAuthentication no

Restart SSH after changes:

sudo systemctl restart ssh

✔ (Optional) Change SSH port

Not security-proof — but reduces bot noise:

Port 2222

🛡 Step 2 — Enable a Firewall

If you haven’t already, UFW is simple and effective.

Allow SSH first:

sudo ufw allow 2222/tcp

(or 22 if default)

Allow web:

sudo ufw allow 80
sudo ufw allow 443

Then enable:

sudo ufw enable

Done 👍

🔄 Step 3 — Keep Your System Updated

Outdated software = open doors.

Update regularly:

sudo apt update && sudo apt upgrade

or on RHEL/CentOS:

sudo yum update

I like to automate security patches — but never blindly auto-upgrade everything on production without testing, especially databases.

Balance is key.

👥 Step 4 — Limit Who Can Do What (User Permissions)

Good rule:

👉 No one should have more access than they need.

Create normal users — don’t use root daily.

Add a user:

sudo adduser john

Give sudo only when needed:

sudo usermod -aG sudo john

Check who has sudo:

getent group sudo

If someone leaves your team — remove access. Immediately.

🧱 Step 5 — Install Fail2Ban (Stops Brute-Force Attacks)

Fail2Ban monitors logs and bans abusive IPs.

Install:

sudo apt install fail2ban

Enable:

sudo systemctl enable fail2ban
sudo systemctl start fail2ban

Check:

sudo fail2ban-client status

It quietly protects you in the background.

🔍 Step 6 — Monitor Logs (Your Server Talks — Listen)

Useful logs:

/var/log/auth.log
/var/log/syslog
/var/log/nginx/error.log
journalctl -xe

Sometimes the first sign of an attack is right there.

I recommend checking occasionally — especially after unusual behavior.

📦 Step 7 — Remove Stuff You Don’t Need

Every service = another thing to attack.

List services:

systemctl list-units --type=service

Ask yourself:

👉 “Do I really need this running?”

If not, disable it:

sudo systemctl disable service-name
sudo systemctl stop service-name

Minimalism = security.

🔒 Step 8 — Secure File Permissions

Web directories should NOT be world-writable.

Example:

sudo chown -R www-data:www-data /var/www/html
sudo chmod -R 755 /var/www/html

Avoid 777 unless you love chaos 😄

🧪 Step 9 — Protect Against Port Scans & Ping Floods (Optional)

Block ping (optional — not always recommended):

sudo nano /etc/sysctl.conf

Add:

net.ipv4.icmp_echo_ignore_all = 1

Apply:

sudo sysctl -p

This reduces visibility — but may break monitoring. Use carefully.

🗂 Step 10 — Always Have Backups

Hard truth:

Security is never absolute. Backups are survival.

Back up:

✔ databases
✔ configs
✔ app files
✔ SSL certs

Test restore occasionally.

A backup you’ve never tested…
is just a hope, not a plan.

🚨 Step 11 — Disable Root Cron Abuse

Only allow necessary cron jobs.

List:

crontab -l
sudo ls /etc/cron.*

Delete unknown jobs immediately — malware often hides here.

🧠 Security Mindset (This Matters More Than Tools)

Linux hardening isn’t about installing fancy tools.

It’s about habits:

✔ minimal access
✔ updates
✔ monitoring
✔ backups
✔ least privilege
✔ logs

And most importantly…

👉 thinking before doing anything as root.

🧩 Extra Security Ideas (When You’re Ready)

Later, you can also explore:

🔐 2FA SSH
🔐 SELinux / AppArmor
🔐 WAF for websites (like Cloudflare)
🔐 IDS tools (OSSEC, Wazuh)
🔐 Audit logs

But don’t overwhelm yourself — start simple.

🎯 Final Thoughts

Hardening a Linux server is not a one-time job.

It’s a mindset.

With just the steps above, you already reduce risk massively:

✅ SSH secured
✅ Firewall enabled
✅ Brute-force blocked
✅ Permissions controlled
✅ Logs monitored
✅ Backups ready

And all without breaking your workflow.

Because security should protect you —
not make your life miserable.

Advertisement
Back to Linuxserver