Skip to content
Maple Web Host Guide
Menu

Cloud & Server Infrastructure

Production Linux Server Hardening: Essential Security Checklist

Last reviewed

Terminal window with a security shield and padlock

Summary: To harden a new Linux server: create a non-root sudo user, switch SSH to key-only authentication, enable a default-deny firewall, install Fail2ban, turn on automatic security updates, and keep audit logs. These six steps block the vast majority of automated attacks. Commands below are for Ubuntu LTS.

1. Create a sudo user

terminalbash
adduser deploy
usermod -aG sudo deploy
# From your workstation, copy your public key:
ssh-copy-id deploy@your.server.ip

2. Lock down SSH

Edit /etc/ssh/sshd_config (or add a file in /etc/ssh/sshd_config.d/) so only key-based logins by named users are allowed. Keep your current session open while testing a new one, so a mistake does not lock you out.

/etc/ssh/sshd_config.d/99-hardening.conftext
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
PubkeyAuthentication yes
AllowUsers deploy
MaxAuthTries 3
X11Forwarding no
terminalbash
sudo sshd -t && sudo systemctl reload ssh

3. Enable a default-deny firewall

How inbound traffic is filtered

  1. 01

    Packet arrives

  2. 02

    UFW rules

    Allow 22, 80, 443 only

  3. 03

    Fail2ban

    Bans IPs after repeated failures

  4. 04

    Service

    SSH, Nginx

terminalbash
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw allow 'Nginx Full'
sudo ufw enable
sudo ufw status verbose

4. Install Fail2ban

terminalbash
sudo apt install -y fail2ban
sudo tee /etc/fail2ban/jail.local >/dev/null <<'EOF'
[sshd]
enabled  = true
maxretry = 5
findtime = 10m
bantime  = 1h
EOF
sudo systemctl enable --now fail2ban
sudo fail2ban-client status sshd

5. Automatic security updates

terminalbash
sudo apt install -y unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades
# Check what would run:
sudo unattended-upgrade --dry-run --debug

6. Audit logging

terminalbash
sudo apt install -y auditd
# Watch changes to user and sudo configuration
echo '-w /etc/passwd -p wa -k identity
-w /etc/sudoers -p wa -k sudoers' | sudo tee /etc/audit/rules.d/hardening.rules
sudo augenrules --load
sudo ausearch -k identity

Hardening checklist

  • Non-root sudo user created
  • Root login and passwords disabled for SSH
  • Firewall default-deny with only needed ports
  • Fail2ban active on SSH
  • Unattended security upgrades enabled
  • auditd watching identity and sudo files
  • Unused services disabled (check: ss -tulpn)
  • Off-server backups scheduled

Next, build your web stack with the LEMP stack guide, or browse more topics in server infrastructure. Choosing a server? See VPS hosting for developers.

Get new technical guides by email

Occasional, practical server and hosting tutorials for Canadian webmasters. Unsubscribe any time.