Hardening a new Linux server: the first hour checklist

Automated scanners probe every public IP address on the internet continuously. A new server with a weak password or an open service can be found and attacked before you have finished installing your application. Hardening is not one big task; it is a short list of things done in the right order.

Access

1. Update everything first: apply all pending security updates and reboot if the kernel changed.
2. Create a personal user with sudo rights. Do not work as root.
3. Use SSH keys, then disable password authentication and direct root login in the SSH configuration.
4. Limit who can connect. Restrict SSH to known IP addresses or put it behind a VPN where possible.

Network

• Enable a host firewall that denies inbound traffic by default and allows only the ports you need, for example 22 (restricted), 80 and 443.
• Check what is listening with a command such as ss -tlnp and remove or bind to localhost any service that should not be public, such as databases and caches.
• Apply the same rules to IPv6.

Ongoing protection

• Enable automatic security updates, or schedule patching with a clear owner.
• Install a tool that bans repeated failed logins, such as fail2ban.
• Keep the clock accurate with NTP; logs and certificates depend on it.
• Send logs off the server, so an attacker cannot erase their tracks.
• Turn on regular backups and test a restore before you rely on them.

Applications

• Run each service as its own unprivileged user.
• Keep secrets out of code repositories and world-readable files.
• Remove default pages, sample apps and unused packages.
• Use TLS for every service that carries data, including internal ones.

Keep a record

Write down what you changed. A short runbook makes the next server faster to set up and makes audits far easier.

How IDX helps

IDX VPS and dedicated servers come with full root access so you can apply this checklist yourself. If you would rather not, our managed servers service covers patching, monitoring, hardening and incident response.