Server security is one of the most critical skills any system administrator must master. A Linux server left with default configurations is an easy target for attackers — from brute-force SSH attempts and service vulnerability exploitation to cryptojacking malware and spam relays.

According to Shodan and Censys, over 30 million Linux servers are connected to the public internet, and a significant portion still run default configurations — root login enabled, password authentication enabled, and firewall disabled. These are open doors for automated wide-scan attacks.

This guide walks you through 10 essential server hardening measures, from basic to advanced, applicable to all major Linux distributions (Ubuntu, Debian, CentOS, Rocky Linux, AlmaLinux). If you are new to the command line, first review our basic Linux commands for hosting management.

1. SSH Hardening — Locking Down the Main Entry Point

SSH (Secure Shell) is the most common remote administration protocol. If SSH is compromised, attackers gain full control of your server. This is the first and most important step in server security.

1.1 Disable Root Login

The root user has unrestricted access to the system. Instead of logging in directly as root, create a sudo user and elevate privileges only when needed:

# Create a new user
sudo adduser admin

# Add to sudo group
sudo usermod -aG sudo admin

# Verify
su - admin
sudo whoami  # Output: root

Then disable root login in SSH:

sudo nano /etc/ssh/sshd_config
# Set: PermitRootLogin no

1.2 Use SSH Key Authentication Instead of Passwords

SSH keys are far more secure than passwords, using 2048 or 4096-bit asymmetric cryptography:

# On your local machine (not the server)
ssh-keygen -t rsa -b 4096 -C "email@example.com"

# Copy the public key to the server
ssh-copy-id admin@your-server-ip

# Verify key-based login works
ssh admin@your-server-ip

After confirming key-based access works, disable password authentication:

sudo nano /etc/ssh/sshd_config
# Set the following:
PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM no

# Restart SSH
sudo systemctl restart sshd

Warning: Before turning off PasswordAuthentication, make sure you can log in with your SSH key. Otherwise, you will lock yourself out of the server!

1.3 Change the Default SSH Port

Port 22 is the first target for attack bots. Changing it (e.g., to 2222) significantly reduces failed login attempts in your logs:

sudo nano /etc/ssh/sshd_config
# Find: #Port 22
# Change to: Port 2222

# Update firewall (if using UFW)
sudo ufw allow 2222/tcp
sudo ufw delete allow 22/tcp

sudo systemctl restart sshd

1.4 Restrict SSH Access to Specific Users

Only allow certain users to log in via SSH:

sudo nano /etc/ssh/sshd_config
# Add:
AllowUsers admin devops operator

sudo systemctl restart sshd

If you use PuTTY on Windows, see our guide to downloading and using PuTTY for proper SSH key configuration.

2. Firewall Configuration

The firewall is your server's first line of defense, controlling inbound and outbound traffic based on ports, protocols, and IP addresses.

2.1 Using UFW (Uncomplicated Firewall) — Ubuntu/Debian

UFW simplifies iptables management. It's the easiest option for beginners:

# Install (usually pre-installed on Ubuntu)
sudo apt update
sudo apt install ufw -y

# Default policies
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow SSH (use your custom port if changed)
sudo ufw allow ssh
# Or: sudo ufw allow 2222/tcp

# Allow HTTP/HTTPS
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

# Enable UFW
sudo ufw enable

# Check status
sudo ufw status verbose

2.2 Using firewalld — CentOS/RHEL/Rocky Linux

# Install
sudo dnf install firewalld -y
sudo systemctl enable --now firewalld

# Allow services
sudo firewall-cmd --permanent --add-service=ssh
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

# Verify
sudo firewall-cmd --list-all

Learn more about deploying a secure web server in our guide to installing Nginx on a VPS, which includes firewall configuration.

3. Fail2ban — Automatic Brute-Force Protection

Fail2ban scans server logs for repeated failed authentication attempts and automatically adds firewall rules to block offending IPs:

# Install
sudo apt install fail2ban -y    # Ubuntu/Debian
# sudo dnf install fail2ban -y  # CentOS/RHEL

# Copy the configuration file
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

# Edit configuration
sudo nano /etc/fail2ban/jail.local

Add or modify these settings:

[DEFAULT]
bantime = 1h
findtime = 10m
maxretry = 5

[sshd]
enabled = true
port = ssh
logpath = %(sshd_log)s
maxretry = 3

You can configure Fail2ban for many services — web servers (Apache/Nginx), Postfix, Dovecot, vsftpd, and more:

# Start the service
sudo systemctl enable --now fail2ban

# Check status
sudo fail2ban-client status
sudo fail2ban-client status sshd

4. Automatic Security Updates

Outdated software with known vulnerabilities is the leading cause of server breaches. Timely updates are simple yet extremely effective.

4.1 Manual System Updates

sudo apt update && sudo apt upgrade -y          # Ubuntu/Debian
# sudo dnf update -y                            # CentOS/RHEL

Check for security-specific updates:

sudo apt list --upgradable 2>/dev/null | grep -i security

4.2 Configure Automatic Updates (unattended-upgrades)

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades
# Select "Yes" when prompted

Verify the configuration:

sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

Ensure these lines are uncommented:

"origin=Ubuntu,archive=jammy-security";
"origin=Debian,archive=bookworm-security";

Note: For production servers, you should have a staging environment to test updates before applying them to production.

If you are learning about server environments, read our guide to VPS hosting to understand the infrastructure you are managing.

5. User and Permission Management

5.1 Principle of Least Privilege

Each user should have only the minimum permissions needed to do their job:

# Create a user with home directory
sudo adduser username

# Add to a specific group instead of sudo
sudo usermod -aG www-data username  # Example: web group

# Remove unused users
sudo deluser username
sudo rm -rf /home/username

5.2 Secure File Permissions

# Files: 644 (rw-r--r--)
# Directories: 755 (rwxr-xr-x)

# Set secure default umask
echo "umask 027" >> ~/.bashrc

# Example for a web directory
sudo chown -R www-data:www-data /var/www/html
sudo find /var/www/html -type d -exec chmod 755 {} \;
sudo find /var/www/html -type f -exec chmod 644 {} \;

5.3 Lock Inactive Accounts

# Lock an account
sudo passwd -l username

# Change shell to /usr/sbin/nologin
sudo usermod -s /usr/sbin/nologin username

6. Securing Common Services

6.1 MySQL/MariaDB

# Run the security script
sudo mysql_secure_installation

This script guides you through:

• Setting a root password
• Removing anonymous users
• Disabling remote root login
• Removing test databases
• Reloading privilege tables

Create dedicated users for each application instead of using root:

CREATE USER 'appname'@'localhost' IDENTIFIED BY 'strong_password';
GRANT ALL PRIVILEGES ON app_db.* TO 'appname'@'localhost';
FLUSH PRIVILEGES;

6.2 PHP Security

Secure PHP configuration in php.ini:

disable_functions = exec,passthru,shell_exec,system,popen,proc_open,curl_exec,curl_multi_exec
open_basedir = /var/www/html:/tmp
expose_php = Off
display_errors = Off
allow_url_fopen = Off
allow_url_include = Off

6.3 Nginx / Apache

Add security headers to your web server configuration:

# Nginx — inside server block
add_header X-Frame-Options "SAMEORIGIN" always;
add_header X-Content-Type-Options "nosniff" always;
add_header X-XSS-Protection "1; mode=block" always;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
add_header Referrer-Policy "strict-origin-when-cross-origin" always;
add_header Permissions-Policy "geolocation=(), microphone=(), camera=()" always;

Hide server version information:

# Nginx: in http block
server_tokens off;

# Apache: in httpd.conf or .htaccess
ServerTokens Prod
ServerSignature Off

For deeper configuration guides, read our articles on what is Nginx and what is Apache.

7. Kernel Hardening

Tune kernel parameters via sysctl to protect against various network-level attacks:

sudo nano /etc/sysctl.d/99-security.conf

Add the following lines:

# Prevent IP Spoofing
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Disable IP forwarding (unless needed as a router)
net.ipv4.ip_forward = 0
net.ipv6.conf.all.forwarding = 0

# Protect against SYN Flood
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_syn_retries = 2
net.ipv4.tcp_synack_retries = 2

# Ignore ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.secure_redirects = 0
net.ipv4.conf.all.send_redirects = 0

# Protect against time-wait assassination
net.ipv4.tcp_rfc1337 = 1

# Disable source routing
net.ipv4.conf.all.accept_source_route = 0

Apply immediately without rebooting:

sudo sysctl -p /etc/sysctl.d/99-security.conf

8. Intrusion Detection and Security Auditing

8.1 Lynis — Comprehensive Security Audit Tool

Lynis scans your entire system, identifies weaknesses, and provides remediation suggestions:

# Install
sudo apt install lynis -y

# Run an audit
sudo lynis audit system

# View suggestions
sudo lynis show suggestions

The output includes an overall security score and a detailed list of recommendations.

8.2 RKHunter — Rootkit Detection

Rootkits are malware that hide deep within the system, often undetectable by regular antivirus tools:

sudo apt install rkhunter -y

# Update the database
sudo rkhunter --propupd

# Run a check
sudo rkhunter --check --skip-keypress

8.3 AIDE — File Integrity Monitoring

AIDE (Advanced Intrusion Detection Environment) creates a checksum database of critical files and alerts you to any changes:

sudo apt install aide -y

# Initialize the database
sudo aideinit
sudo mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db

# Run daily checks
sudo aide --check

Combine this with our website security guide for comprehensive protection at both the application and operating system layers.

9. Log Monitoring and Early Warning

9.1 Logrotate — Managing Log File Size

Server logs can consume gigabytes of disk space if not rotated:

sudo nano /etc/logrotate.d/custom

Add this configuration:

/var/log/*.log {
    weekly
    rotate 4
    compress
    delaycompress
    missingok
    notifempty
    postrotate
        systemctl reload rsyslog
    endscript
}

9.2 Auditd — System Behavior Monitoring

auditd records every action on the system — who accessed which file, what command was executed:

sudo apt install auditd -y
sudo systemctl enable --now auditd

# Monitor changes to critical configuration files
sudo auditctl -w /etc/ssh/sshd_config -p wa -k ssh_config
sudo auditctl -w /etc/passwd -p wa -k user_db
sudo auditctl -w /etc/shadow -p wa -k shadow_db

# View logs
sudo ausearch -k ssh_config

9.3 Logwatch — Daily Log Reports

sudo apt install logwatch -y

# Send daily reports via email
sudo logwatch --detail high --mailto admin@example.com --service All --range yesterday

10. Server Security Checklist

Here is an HTML checklist you can print and mark off as you complete each step:

FAQ — Frequently Asked Questions About Server Security

How is server security different from website security?

Server security focuses on the operating system and infrastructure — SSH, firewall, kernel, users, background services. Website security focuses on the application — CMS, plugins, SQL injection, XSS, SSL, WAF. These two layers complement each other. See our website security guide for details.

Is it really necessary to disable root login?

Yes. This is the single most important security measure. Root has full system privileges, and SSH logs will always show hundreds of root login attempts from bots. Use a sudo user and switch to root only when needed with sudo -i or su -.

What should I do after completing the initial setup?

Keep your system updated regularly, monitor logs periodically, and run a Lynis audit every month. If you are using cloud hosting, learn more about what is cloud hosting to understand the additional security layers your provider offers.

Is UFW enough to protect my server?

UFW is a front-end for iptables and is sufficient for blocking unwanted connections at a basic level. However, you should combine it with Fail2ban, and for web application protection, add a WAF like Cloudflare or ModSecurity.

How can I tell if my server has been compromised?

Common signs: abnormally high CPU usage (possible cryptominer), sudden network traffic spikes, unfamiliar files, unknown user accounts, strange IPs in SSH logs, and injected malicious code on your website. Run rkhunter and lynis audit immediately.

Does server security affect website performance?

Most measures have negligible performance impact. Some configurations like SYN cookies or rate limiting actually help your server stay stable under attack. Fail2ban and the firewall have virtually no effect on performance.

Should I use AppArmor or SELinux?

If your server handles sensitive data or is part of a critical system, enable AppArmor (Ubuntu/Debian) or SELinux (CentOS/RHEL). These provide Mandatory Access Control (MAC) that prevents unauthorized actions even when vulnerabilities exist.

How often should I audit my server security?

For production servers, check logs and updates weekly, run a full audit monthly, and perform rootkit scans quarterly.

Conclusion

Server security is not a destination but an ongoing process. The ten measures in this guide form a solid foundation for protecting your Linux machine:

1. SSH hardening — lock the front door
2. Firewall — control network traffic
3. Fail2ban — auto-block brute-force attempts
4. Security updates — patch vulnerabilities on time
5. User management — least privilege principle
6. Service security — MySQL, PHP, Nginx/Apache
7. Kernel hardening — reinforce the operating system core
8. Intrusion detection — Lynis, rkhunter, AIDE
9. Log monitoring — auditd, logwatch
10. Checklist — verify and repeat regularly

If you are just getting started, work through steps 1–5 on your first day, then add the more advanced measures gradually. Remember — security is a cycle, not a straight line: after completing all steps, go back, check again, and keep everything up to date.

Review our basic Linux commands guide if you need to strengthen your command-line skills before diving into server hardening.