Every server connected to the internet is under attack. Within minutes of provisioning a new server with a public IP address, automated scanners will find it and begin probing for vulnerabilities. SSH brute-force attempts, port scans, web application attacks, and exploit attempts are constant background noise on the internet. A default Linux installation — with password-based SSH, no firewall, and unnecessary services running — is trivially compromised by these automated attacks.
Server hardening is the process of reducing the attack surface and strengthening defenses so that even if an attacker finds your server, they can't get in. This guide covers every essential hardening step for production Linux servers, organized from most critical to supplementary. We use Ubuntu/Debian commands throughout, but the concepts apply to all Linux distributions with minor command differences.
Chapter 1: Initial Access Security — SSH Hardening
SSH is the front door to your server. If SSH is compromised, everything else is irrelevant. Default SSH configuration allows password authentication, permits root login, and listens on port 22 — all of which make brute-force attacks trivially easy.
Step 1: Create a Non-Root User
Never use the root account for daily administration. Create a regular user, grant it sudo privileges, and disable root login entirely.
# Create a new admin user
adduser deployer
# Add to sudo group
usermod -aG sudo deployer
# Verify sudo access (switch to the new user first)
su - deployer
sudo whoami # Should output: root
# Lock the root password (prevents root login via password)
sudo passwd -l rootStep 2: SSH Key Authentication Only
Passwords can be brute-forced. SSH keys cannot (with practical key sizes). Disable password authentication entirely and require key-based authentication.
# On your LOCAL machine, generate an SSH key pair (if you don't have one)
ssh-keygen -t ed25519 -C "your_email@example.com"
# Copy your public key to the server
ssh-copy-id -i ~/.ssh/id_ed25519.pub deployer@your-server-ip
# Verify you can log in with the key
ssh deployer@your-server-ip
# Now disable password authentication on the server
sudo nano /etc/ssh/sshd_configApply these SSH configuration changes:
# /etc/ssh/sshd_config — hardened configuration
# Disable password authentication (keys only)
PasswordAuthentication no
ChallengeResponseAuthentication no
UsePAM yes
# Disable root login
PermitRootLogin no
# Disable empty passwords
PermitEmptyPasswords no
# Use only SSH protocol 2 (protocol 1 is insecure)
Protocol 2
# Use strong key exchange algorithms
KexAlgorithms sntrup761x25519-sha512@openssh.com,curve25519-sha256,curve25519-sha256@libssh.org,diffie-hellman-group16-sha512,diffie-hellman-group18-sha512
# Use strong ciphers
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
# Use strong MACs
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com
# Use strong host key algorithms
HostKeyAlgorithms ssh-ed25519,ssh-ed25519-cert-v01@openssh.com,rsa-sha2-512,rsa-sha2-256
# Limit login attempts
MaxAuthTries 3
# Set login grace time (seconds to authenticate)
LoginGraceTime 30
# Limit simultaneous unauthenticated connections
MaxStartups 10:30:60
# Disable X11 forwarding (unless needed)
X11Forwarding no
# Disable TCP forwarding (unless needed)
AllowTcpForwarding no
# Disable agent forwarding (unless needed)
AllowAgentForwarding no
# Set idle timeout (disconnect idle sessions after 10 minutes)
ClientAliveInterval 300
ClientAliveCountMax 2
# Restrict SSH access to specific users
AllowUsers deployer
# Log more details
LogLevel VERBOSE
# Change SSH port (optional, reduces automated scans)
# Port 2222
# Disable SSH banner (don't reveal server info)
Banner none
DebianBanner no# Validate configuration before restarting
sudo sshd -t
# If no errors, restart SSH
sudo systemctl restart sshd
# IMPORTANT: Keep your current session open!
# Open a NEW terminal and verify you can still log in
# before closing the current session.Step 3: Fail2Ban — Automatic Brute-Force Protection
Even with key-only authentication, brute-force attempts consume server resources and fill logs. Fail2Ban monitors log files and automatically bans IP addresses that show malicious behavior.
# Install Fail2Ban
sudo apt-get update && sudo apt-get install -y fail2ban
# Create local configuration (never edit the default config)
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local
sudo nano /etc/fail2ban/jail.local# /etc/fail2ban/jail.local — key settings
[DEFAULT]
# Ban duration: 1 hour (increase for repeat offenders)
bantime = 3600
# Time window for counting failures
findtime = 600
# Number of failures before ban
maxretry = 3
# Whitelist your own IP (IMPORTANT: replace with your IP)
ignoreip = 127.0.0.1/8 ::1 YOUR_OFFICE_IP
# Email notification (optional)
# destemail = admin@yourdomain.com
# action = %(action_mwl)s
[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600
# Progressive banning: repeat offenders get longer bans
[sshd-aggressive]
enabled = true
port = ssh
filter = sshd[mode=aggressive]
logpath = /var/log/auth.log
maxretry = 1
bantime = 86400 # 24 hours for aggressive offenders
findtime = 86400# Start and enable Fail2Ban
sudo systemctl enable fail2ban
sudo systemctl start fail2ban
# Check status and banned IPs
sudo fail2ban-client status sshd
sudo fail2ban-client status sshd-aggressive
# Manually unban an IP (if you accidentally locked yourself out)
sudo fail2ban-client set sshd unbanip YOUR_IPChapter 2: Firewall Configuration
A firewall controls which network traffic is allowed to reach your server and which traffic your server can send. Without a firewall, every service on your server is accessible to the entire internet.
UFW (Uncomplicated Firewall)
UFW is a user-friendly frontend for iptables. It provides simple commands for common firewall rules.
# Default policy: deny all incoming, allow all outgoing
sudo ufw default deny incoming
sudo ufw default allow outgoing
# Allow SSH (IMPORTANT: do this BEFORE enabling the firewall)
sudo ufw allow ssh
# Or if you changed the SSH port:
# sudo ufw allow 2222/tcp
# Allow HTTP and HTTPS (for web servers)
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
# Allow specific services only from specific IPs
# Example: Allow PostgreSQL only from your application server
sudo ufw allow from 10.0.1.5 to any port 5432
# Allow a specific IP range (e.g., your office)
sudo ufw allow from 203.0.113.0/24
# Rate limiting for SSH (additional protection)
sudo ufw limit ssh
# Enable the firewall
sudo ufw enable
# Check status
sudo ufw status verbose
# Output should look like:
# Status: active
# Logging: on (low)
# Default: deny (incoming), allow (outgoing), disabled (routed)
#
# To Action From
# -- ------ ----
# 22/tcp LIMIT Anywhere
# 80/tcp ALLOW Anywhere
# 443/tcp ALLOW Anywhere
# 5432 ALLOW 10.0.1.5Advanced: Nftables Rules
For more complex setups, nftables (the successor to iptables) provides greater flexibility. Use nftables when you need: rate limiting per source IP, connection tracking, geo-blocking, port knocking, or complex NAT rules.
# /etc/nftables.conf — production-grade ruleset
table inet filter {
# Rate limit SSH connections
set ssh_ratelimit {
type ipv4_addr
flags dynamic, timeout
timeout 1m
}
chain input {
type filter hook input priority 0; policy drop;
# Allow established connections
ct state established,related accept
# Allow loopback
iif "lo" accept
# Drop invalid connections
ct state invalid drop
# Allow ICMP (ping) with rate limit
ip protocol icmp limit rate 5/second accept
ip6 nexthdr icmpv6 limit rate 5/second accept
# SSH with rate limiting (max 3 new connections per minute per IP)
tcp dport 22 ct state new add @ssh_ratelimit { ip saddr limit rate 3/minute } accept
# HTTP and HTTPS
tcp dport { 80, 443 } accept
# Log dropped packets (for debugging)
limit rate 5/minute log prefix "nftables-dropped: " level info
}
chain forward {
type filter hook forward priority 0; policy drop;
}
chain output {
type filter hook output priority 0; policy accept;
}
}Chapter 3: System Updates and Patch Management
Unpatched software is the most common vulnerability exploited in real-world attacks. Every major breach investigation traces back to a known vulnerability that had a patch available but wasn't applied.
Automatic Security Updates
# Install unattended-upgrades
sudo apt-get install -y unattended-upgrades apt-listchanges
# Configure automatic security updates
sudo dpkg-reconfigure -plow unattended-upgrades
# Edit the configuration for fine-tuned control
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades// /etc/apt/apt.conf.d/50unattended-upgrades
Unattended-Upgrade::Allowed-Origins {
// Security updates only (safest option)
"${distro_id}:${distro_codename}-security";
"${distro_id}ESMApps:${distro_codename}-apps-security";
"${distro_id}ESM:${distro_codename}-infra-security";
};
// Auto-remove unused dependencies
Unattended-Upgrade::Remove-Unused-Dependencies "true";
// Automatically reboot if required (at 3 AM)
Unattended-Upgrade::Automatic-Reboot "true";
Unattended-Upgrade::Automatic-Reboot-Time "03:00";
// Email notification
Unattended-Upgrade::Mail "admin@yourdomain.com";
Unattended-Upgrade::MailReport "on-change";# Verify it's working
sudo unattended-upgrade --dry-run
# Check logs
cat /var/log/unattended-upgrades/unattended-upgrades.logChapter 4: User and Permission Management
Principle of Least Privilege
Every user and service should have the minimum permissions needed to do their job. No more, no less.
# Review existing users
cat /etc/passwd | awk -F: '$3 >= 1000 { print $1, $3, $7 }'
# Disable unused accounts
sudo usermod -L -s /usr/sbin/nologin username
# Review sudo access
sudo cat /etc/sudoers
sudo ls -la /etc/sudoers.d/
# Restrict sudo to specific commands (instead of ALL)
# Create a file in /etc/sudoers.d/
sudo visudo -f /etc/sudoers.d/deployer# /etc/sudoers.d/deployer
# Allow deployer to restart services and view logs only
deployer ALL=(ALL) NOPASSWD: /bin/systemctl restart nginx, /bin/systemctl restart myapp, /bin/systemctl status *, /bin/journalctl *Service Accounts
Applications should run under dedicated service accounts, not as root and not under personal user accounts.
# Create a service account (no home directory, no login shell)
sudo useradd --system --no-create-home --shell /usr/sbin/nologin myapp
# Set file ownership
sudo chown -R myapp:myapp /opt/myapp
# Create a systemd service that runs as the service account
sudo nano /etc/systemd/system/myapp.service# /etc/systemd/system/myapp.service
[Unit]
Description=My Application
After=network.target
[Service]
Type=simple
User=myapp
Group=myapp
WorkingDirectory=/opt/myapp
ExecStart=/opt/myapp/bin/server
Restart=on-failure
RestartSec=5
# Security hardening directives
NoNewPrivileges=yes
ProtectSystem=strict
ProtectHome=yes
PrivateTmp=yes
PrivateDevices=yes
ProtectKernelTunables=yes
ProtectKernelModules=yes
ProtectControlGroups=yes
RestrictRealtime=yes
RestrictSUIDSGID=yes
MemoryDenyWriteExecute=yes
ReadWritePaths=/opt/myapp/data /var/log/myapp
CapabilityBoundingSet=CAP_NET_BIND_SERVICE
AmbientCapabilities=CAP_NET_BIND_SERVICE
[Install]
WantedBy=multi-user.targetThe systemd security directives above provide defense-in-depth: NoNewPrivileges prevents the process from gaining additional privileges. ProtectSystem=strict makes the entire filesystem read-only except explicitly listed paths. PrivateTmp gives the service its own /tmp directory. MemoryDenyWriteExecute prevents the service from creating executable memory regions (blocks common exploit techniques).
Chapter 5: File System Security
Partition Security
Mount partitions with restrictive options to limit what can happen on each filesystem:
# /etc/fstab — add security mount options
# /tmp — noexec prevents running executables from /tmp
# (a common attacker technique)
tmpfs /tmp tmpfs defaults,noexec,nosuid,nodev,size=2G 0 0
# /var/tmp — same restrictions
tmpfs /var/tmp tmpfs defaults,noexec,nosuid,nodev,size=1G 0 0
# /dev/shm — shared memory, restrict execution
tmpfs /dev/shm tmpfs defaults,noexec,nosuid,nodev 0 0File Permissions Audit
# Find world-writable files (potential security risk)
sudo find / -xdev -type f -perm -0002 -ls 2>/dev/null
# Find world-writable directories (without sticky bit)
sudo find / -xdev -type d ( -perm -0002 -a ! -perm -1000 ) -ls 2>/dev/null
# Find files with SUID bit set (can run as owner, often root)
sudo find / -xdev -type f -perm -4000 -ls 2>/dev/null
# Find files with SGID bit set
sudo find / -xdev -type f -perm -2000 -ls 2>/dev/null
# Find files with no owner (orphaned files)
sudo find / -xdev -nouser -ls 2>/dev/null
sudo find / -xdev -nogroup -ls 2>/dev/null
# Secure critical files
sudo chmod 600 /etc/shadow
sudo chmod 644 /etc/passwd
sudo chmod 600 /etc/ssh/sshd_config
sudo chmod 700 /rootFile Integrity Monitoring with AIDE
AIDE (Advanced Intrusion Detection Environment) creates a database of file checksums and alerts you when files change unexpectedly. This detects: unauthorized modifications to configuration files, new binaries installed by attackers, changes to critical system files, and backdoors planted in existing executables.
# Install AIDE
sudo apt-get install -y aide
# Initialize the database (takes a few minutes)
sudo aideinit
# Copy the new database
sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db
# Run a check (compare current state to database)
sudo aide --check
# Set up daily checks via cron
sudo nano /etc/cron.daily/aide-check#!/bin/bash
# /etc/cron.daily/aide-check
REPORT=/var/log/aide/aide-report-$(date +%Y%m%d).txt
/usr/bin/aide --check > "$REPORT" 2>&1
# Only send email if changes were detected
if [ $? -ne 0 ]; then
mail -s "AIDE Alert: File Changes Detected on $(hostname)" admin@yourdomain.com < "$REPORT"
fiChapter 6: Kernel Hardening
The Linux kernel has tunable security parameters that are not optimally configured by default. Apply these via sysctl:
# /etc/sysctl.d/99-security.conf
# Prevent IP spoofing
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1
# Disable IP source routing (prevents spoofing attacks)
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.default.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0
net.ipv6.conf.default.accept_source_route = 0
# Disable ICMP redirect acceptance (prevents MITM attacks)
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.default.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0
net.ipv6.conf.default.accept_redirects = 0
# Disable sending ICMP redirects (only needed on routers)
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0
# Enable TCP SYN cookies (prevents SYN flood attacks)
net.ipv4.tcp_syncookies = 1
# Log suspicious packets (martians)
net.ipv4.conf.all.log_martians = 1
net.ipv4.conf.default.log_martians = 1
# Disable IPv6 if not needed
# net.ipv6.conf.all.disable_ipv6 = 1
# net.ipv6.conf.default.disable_ipv6 = 1
# Protect against time-wait assassination
net.ipv4.tcp_rfc1337 = 1
# Enable kernel address space layout randomization (ASLR)
kernel.randomize_va_space = 2
# Restrict access to kernel pointers in /proc
kernel.kptr_restrict = 2
# Restrict access to dmesg
kernel.dmesg_restrict = 1
# Restrict ptrace (prevents process debugging/injection)
kernel.yama.ptrace_scope = 2
# Disable core dumps (prevent information leakage)
fs.suid_dumpable = 0
# Restrict unprivileged user namespaces
# (prevents some container escape techniques)
kernel.unprivileged_userns_clone = 0
# Harden BPF JIT compiler
net.core.bpf_jit_harden = 2# Apply without reboot
sudo sysctl -p /etc/sysctl.d/99-security.conf
# Verify settings
sudo sysctl -a | grep randomize_va_spaceChapter 7: Audit Logging
Audit logging records security-relevant events on the system. Without audit logs, you can't investigate incidents, prove compliance, or detect unauthorized access.
# Install auditd
sudo apt-get install -y auditd audispd-plugins
# Configure audit rules
sudo nano /etc/audit/rules.d/hardening.rules# /etc/audit/rules.d/hardening.rules
# Monitor authentication events
-w /etc/passwd -p wa -k identity
-w /etc/group -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/gshadow -p wa -k identity
-w /etc/sudoers -p wa -k sudoers
-w /etc/sudoers.d/ -p wa -k sudoers
# Monitor SSH configuration changes
-w /etc/ssh/sshd_config -p wa -k sshd_config
-w /etc/ssh/ -p wa -k ssh_keys
# Monitor cron changes (persistence mechanism)
-w /etc/crontab -p wa -k cron
-w /etc/cron.d/ -p wa -k cron
-w /var/spool/cron/ -p wa -k cron
# Monitor systemd service changes
-w /etc/systemd/ -p wa -k systemd
-w /lib/systemd/ -p wa -k systemd
# Monitor network configuration
-w /etc/hosts -p wa -k network
-w /etc/sysctl.conf -p wa -k sysctl
-w /etc/sysctl.d/ -p wa -k sysctl
# Monitor firewall changes
-w /etc/ufw/ -p wa -k firewall
-w /etc/nftables.conf -p wa -k firewall
# Log all commands run with sudo
-a always,exit -F arch=b64 -S execve -F euid=0 -k root_commands
-a always,exit -F arch=b32 -S execve -F euid=0 -k root_commands
# Log file deletions
-a always,exit -F arch=b64 -S unlink -S unlinkat -S rename -S renameat -k file_deletion
# Log module loading (rootkit detection)
-w /sbin/insmod -p x -k modules
-w /sbin/rmmod -p x -k modules
-w /sbin/modprobe -p x -k modules
# Make audit configuration immutable (requires reboot to change)
-e 2# Restart auditd
sudo systemctl restart auditd
# Search audit logs
sudo ausearch -k identity --start recent
sudo ausearch -k root_commands --start today
sudo aureport --auth --start todayChapter 8: Disable Unnecessary Services
Every running service is a potential attack vector. Disable everything you don't need.
# List all running services
sudo systemctl list-units --type=service --state=running
# Common services to disable on a web server
sudo systemctl disable --now avahi-daemon # mDNS (not needed on servers)
sudo systemctl disable --now cups # Printing (not needed on servers)
sudo systemctl disable --now bluetooth # Bluetooth
sudo systemctl disable --now ModemManager # Modem management
# List open ports (verify only expected ports are open)
sudo ss -tulnp
# Expected output for a web server:
# LISTEN 0 511 0.0.0.0:443 users:(("nginx",pid=...))
# LISTEN 0 511 0.0.0.0:80 users:(("nginx",pid=...))
# LISTEN 0 128 0.0.0.0:22 users:(("sshd",pid=...))
# If you see unexpected ports, investigate and close them
# sudo systemctl stop unexpected-service
# sudo systemctl disable unexpected-serviceChapter 9: Intrusion Detection with OSSEC/Wazuh
OSSEC (and its enterprise fork Wazuh) is a host-based intrusion detection system (HIDS) that combines log analysis, file integrity monitoring, rootkit detection, and real-time alerting.
# Install Wazuh agent (connects to a central Wazuh server)
curl -s https://packages.wazuh.com/key/GPG-KEY-WAZUH | sudo gpg --no-default-keyring --keyring gnupg-ring:/usr/share/keyrings/wazuh.gpg --import
echo "deb [signed-by=/usr/share/keyrings/wazuh.gpg] https://packages.wazuh.com/4.x/apt/ stable main" | sudo tee /etc/apt/sources.list.d/wazuh.list
sudo apt-get update
sudo apt-get install -y wazuh-agent
# Configure the agent to connect to your Wazuh server
sudo nano /var/ossec/etc/ossec.conf
# Set: <server><address>wazuh-server.internal</address></server>
# Start the agent
sudo systemctl enable wazuh-agent
sudo systemctl start wazuh-agentWazuh provides: real-time log analysis and alerting, file integrity monitoring (like AIDE but with real-time alerts), rootkit detection, vulnerability detection (compares installed packages against CVE databases), regulatory compliance checking (PCI DSS, GDPR, HIPAA), and centralized management of multiple servers.
Chapter 10: The Complete Hardening Checklist
SSH Hardening: ☐ Key-based authentication only (disable passwords). ☐ Root login disabled. ☐ Non-root admin user with sudo. ☐ Strong algorithms only (Ed25519 keys, ChaCha20 cipher). ☐ Fail2Ban installed and configured. ☐ SSH restricted to specific users (AllowUsers). ☐ Idle timeout configured. ☐ Max auth tries set to 3.
Firewall: ☐ Default policy: deny incoming. ☐ Only required ports open (SSH, HTTP, HTTPS). ☐ Internal services restricted by source IP. ☐ Rate limiting on SSH.
Updates: ☐ Automatic security updates enabled. ☐ Reboot schedule for kernel updates. ☐ Email notifications for applied updates.
Users and Permissions: ☐ Principle of least privilege for all users. ☐ Service accounts for applications (no login shell). ☐ Unused accounts disabled. ☐ Sudo restricted to specific commands where possible. ☐ Strong password policy for any remaining password-based accounts.
Filesystem: ☐ /tmp mounted with noexec. ☐ SUID/SGID files audited. ☐ File integrity monitoring (AIDE) configured. ☐ Critical file permissions verified.
Kernel: ☐ SYN cookies enabled. ☐ Source routing disabled. ☐ ICMP redirects disabled. ☐ ASLR enabled. ☐ Core dumps disabled. ☐ Ptrace restricted.
Logging and Monitoring: ☐ Auditd configured with comprehensive rules. ☐ Logs forwarded to centralized logging system. ☐ Intrusion detection (OSSEC/Wazuh) installed. ☐ Alerts configured for security events.
Services: ☐ Unnecessary services disabled. ☐ Only required ports open. ☐ Services run as non-root users. ☐ Systemd security directives applied.
Server hardening is not a one-time task — it's an ongoing process. Review your security configuration quarterly, stay updated on new vulnerabilities and attack techniques, and continuously improve your defenses.
ZeonEdge provides Linux server hardening services, security audits, and managed security monitoring. From initial server setup to ongoing vulnerability management, we keep your infrastructure secure. Contact our infrastructure team for a server security assessment.
Alex Thompson
CEO & Cloud Architecture Expert at ZeonEdge with 15+ years building enterprise infrastructure.