The Ultimate Linux Server Security Hardening Checklist for 2026
Why Server Hardening Matters
Every Linux server deployed on the internet is a potential target. Automated bots scan thousands of IP addresses every minute, probing for open ports, weak credentials, and outdated software. A freshly provisioned Ubuntu or CentOS instance can receive its first brute-force attempt within minutes of going live. Server hardening is the systematic process of reducing your attack surface so that these automated and targeted attacks find nothing exploitable.
Servers running in production datacenters face constant automated and targeted attacks. The most secure deployments share a common trait: they follow a repeatable hardening checklist from day one. This guide distills that checklist into actionable steps you can apply to any Linux distribution.
Step 1: Initial System Updates
The very first thing you should do after provisioning a server is update every package. Outdated packages are the number one vector for initial compromise.
# Ubuntu / Debian
sudo apt update && sudo apt upgrade -y
sudo apt autoremove -y# CentOS / RHEL sudo dnf update -y sudo dnf autoremove -y ```
Enable automatic security updates so critical patches are applied without manual intervention:
# Ubuntu
sudo apt install unattended-upgrades
dpkg-reconfigure -plow unattended-upgrades
For CentOS, use `dnf-automatic`:
sudo dnf install dnf-automatic
sudo systemctl enable --now dnf-automatic-install.timer
Step 2: Secure SSH Access
SSH is the primary management channel for most Linux servers, which makes it a prime target. Apply these changes in `/etc/ssh/sshd_config`:
Port 2222
PermitRootLogin no
PasswordAuthentication no
MaxAuthTries 3
ClientAliveInterval 300
ClientAliveCountMax 2
AllowUsers deploy admin
Changing the default port from 22 to a non-standard port like 2222 eliminates the vast majority of automated brute-force scripts. Disabling root login and password authentication forces the use of SSH keys, which are exponentially harder to crack.
Generate a strong Ed25519 key pair on your local machine:
ssh-keygen -t ed25519 -C "[email protected]"
ssh-copy-id -p 2222 deploy@your-server-ip
After verifying key-based login works, restart the SSH daemon:
sudo systemctl restart sshd
Step 3: Configure a Host-Based Firewall
Every server should run a local firewall in addition to any network-level firewalls. On Ubuntu, UFW (Uncomplicated Firewall) is the standard tool:
sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 2222/tcp comment 'SSH'
sudo ufw allow 80/tcp comment 'HTTP'
sudo ufw allow 443/tcp comment 'HTTPS'
sudo ufw enable
sudo ufw status verbose
On CentOS, use firewalld:
sudo firewall-cmd --permanent --add-port=2222/tcp
sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload
The principle of least privilege applies here: only open ports that your services absolutely require.
Step 4: Install and Configure Fail2Ban
Fail2Ban monitors log files and bans IPs that show malicious patterns such as repeated failed login attempts.
sudo apt install fail2ban
sudo systemctl enable fail2ban
Create a local configuration file at `/etc/fail2ban/jail.local`:
[DEFAULT]
bantime = 3600
findtime = 600
maxretry = 3[sshd] enabled = true port = 2222 logpath = /var/log/auth.log ```
This configuration bans an IP address for one hour after three failed SSH attempts within a ten-minute window. For high-security environments, increase the bantime to 86400 (24 hours) and set maxretry to 1.
Step 5: Enforce Strong Password Policies
Even with SSH keys in place, local user accounts should have strong passwords. Install and configure PAM quality enforcement:
sudo apt install libpam-pwquality
Edit `/etc/security/pwquality.conf`:
minlen = 14
dcredit = -1
ucredit = -1
ocredit = -1
lcredit = -1
maxrepeat = 3
This requires passwords of at least 14 characters with at least one digit, uppercase letter, special character, and lowercase letter, with no more than three repeated characters.
Step 6: Disable Unnecessary Services
Every running service is a potential entry point. Audit your running services:
sudo systemctl list-units --type=service --state=running
Disable anything you do not need:
sudo systemctl disable --now cups
sudo systemctl disable --now avahi-daemon
sudo systemctl disable --now bluetooth
Use `ss -tlnp` to verify which ports are actually listening. If you see a port you cannot account for, investigate immediately.
Step 7: Set Up File Integrity Monitoring
AIDE (Advanced Intrusion Detection Environment) creates a database of file checksums and alerts you when files are modified unexpectedly.
sudo apt install aide
sudo aideinit
sudo cp /var/lib/aide/aide.db.new /var/lib/aide/aide.db
Schedule daily checks via cron:
echo '0 3 * * * root /usr/bin/aide --check | mail -s "AIDE Report" [email protected]' | sudo tee /etc/cron.d/aide-check
Step 8: Enable Audit Logging
The Linux Audit framework provides detailed tracking of system calls and file access.
sudo apt install auditd
sudo systemctl enable auditd
Add rules for critical files in `/etc/audit/rules.d/audit.rules`:
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/sudoers -p wa -k sudoers
-a always,exit -F arch=b64 -S execve -k exec
Restart auditd and generate reports with `aureport`.
Step 9: Configure Kernel Security Parameters
Tune kernel parameters via `/etc/sysctl.d/99-security.conf`:
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.icmp_echo_ignore_broadcasts = 1
net.ipv4.tcp_syncookies = 1
kernel.randomize_va_space = 2
Apply with `sudo sysctl --system`. These settings prevent IP spoofing, disable ICMP redirects, enable SYN flood protection, and enforce ASLR.
Step 10: Regular Security Scanning
Schedule automated vulnerability scans using tools like Lynis:
sudo apt install lynis
sudo lynis audit system
Lynis scores your system out of 100 and provides specific remediation advice. Aim for a hardening index above 80. Run this scan weekly and review the results to catch configuration drift.
Conclusion
Security hardening is not a one-time task -- it is an ongoing discipline. Start with this checklist on every new server deployment, review it quarterly, and stay informed about emerging threats. At ServerRaja, every managed server includes baseline hardening out of the box, but customers running self-managed instances should adopt these practices as a minimum standard. A hardened server is not invulnerable, but it raises the cost of attack high enough that most adversaries will move on to easier targets.