Linux Server Hardening: 10 Must-Do Tasks

Securing a Linux server is crucial to prevent cyberattacks, data breaches, and unauthorized access. Whether you’re running a personal project or a business-critical application, these 10 essential steps will help you lock down your server effectively.

1. Keep Your System Updated

How?

sudo apt update && sudo apt upgrade -y  # Debian/Ubuntu
sudo dnf update -y  # RHEL/Fedora

Enable automatic security updates:

sudo apt install unattended-upgrades
sudo dpkg-reconfigure unattended-upgrades

2. Secure SSH Access

How?

Disable root login:

sudo nano /etc/ssh/sshd_config

Set:

PermitRootLogin no
PasswordAuthentication no  # Use SSH keys instead

Change default SSH port (optional but recommended):

Port 2222  # Example

Restart SSH:

sudo systemctl restart sshd

3.  Configure a Firewall (UFW)

How?

sudo apt install ufw
sudo ufw allow 22/tcp  # Or your custom SSH port
sudo ufw allow 80/tcp  # HTTP
sudo ufw allow 443/tcp  # HTTPS
sudo ufw enable

4. Use SSH Key Authentication (Instead of Passwords)

How?

Generate SSH keys (on your local machine):

ssh-keygen -t ed25519

Copy public key to server:

ssh-copy-id user@your_server_ip -p 2222

5. Install & Configure Fail2Ban

How?

sudo apt install fail2ban
sudo systemctl enable --now fail2ban

Customize jail rules:

sudo nano /etc/fail2ban/jail.local

6. Disable Unnecessary Services

How?

sudo systemctl list-unit-files --type=service | grep enabled

Disable unused services:

sudo systemctl disable servicename

7. Set Up 2FA for SSH (Optional but Recommended)

How?

sudo apt install libpam-google-authenticator
google-authenticator

Then edit /etc/pam.d/sshd and add:

auth required pam_google_authenticator.so

8. Monitor Logs for Intrusion Attempts

How?

sudo tail -f /var/log/auth.log  # SSH attempts
sudo grep "Failed password" /var/log/auth.log

9. Regular Backups

How?

sudo tar -czvf /backup/server-backup-$(date +%F).tar.gz /var/www /etc

Or use rsync:

rsync -avz /var/www user@backup-server:/backups/

10. Audit Security with Lynis

How?

sudo apt install lynis
sudo lynis audit system