Hardening a new Linux server: the first-hour checklist

Why is Linux server security important from day one?

When you bring up a fresh Linux server, you usually only have a few minutes to secure it against automated attacks. As soon as port 22 opens, internet scanners start trying to log in with common usernames like root and admin. If you delay these steps, you will likely see hundreds of failed attempts in your auth.log within the first few hours.

In this article, we provide a practical, step-by-step checklist for securing a fresh Linux server. We assume you are working with an Ubuntu 22.04 or 24.04 server, but almost all commands also work on Debian and other derivatives. The goal is to minimize the server's attack surface in under 30 minutes.

1. Create a non-root user and secure SSH login

The first and most important step is to disable direct login with the root user. Root has full authority on Linux, and if its password is compromised, the attacker gains control of the entire system. Instead, create a regular user with sudo access and use it for daily administration.

Create a new user

Log in to the server as root and run the following commands:

adduser myuser
usermod -aG sudo myuser

The first command creates the user myuser with a home directory and prompts you for a password. The second command adds them to the sudo group so they can run administrative commands. Now log out and log back in with the new user to make sure everything works correctly.

Configure SSH keys instead of passwords

Passwords can be guessed through brute-force attacks, but a public SSH key is mathematically nearly impossible to break. On your local system (not the server), generate a key pair:

ssh-keygen -t ed25519 -a 100

The ed25519 algorithm is faster and more secure than RSA and produces a shorter key. If your server has an older version of OpenSSH, you can use ssh-keygen -t rsa -b 4096. Then copy the public key to the server:

ssh-copy-id myuser@your-server-ip

This command adds your public key to the ~/.ssh/authorized_keys file for the user myuser. Now log in with ssh myuser@your-server-ip and make sure you can log in without a password.

Disable password and root login

Edit the SSH configuration file:

sudo nano /etc/ssh/sshd_config

Change or add these lines:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AllowUsers myuser

The AllowUsers line only permits the specified user to log in and adds an extra security layer. After applying the changes, restart the SSH service:

sudo systemctl restart sshd

2. Configure the firewall with UFW

The firewall is the first line of defense against unauthorized access to open ports. On Ubuntu, the default tool is UFW (Uncomplicated Firewall), which simplifies iptables management.

Enable and set basic rules

Before enabling the firewall, make sure to open the SSH port so your connection is not dropped:

sudo ufw allow OpenSSH
sudo ufw enable

The first command automatically opens port 22. If your SSH runs on a different port, use sudo ufw allow 2222/tcp. Now, if you have a web server or other services, open the relevant ports:

sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

Check the firewall status with sudo ufw status verbose. The output should look something like this:

Status: active
To                         Action      From
--                         ------      ----
22/tcp                     ALLOW       Anywhere
80/tcp                     ALLOW       Anywhere
443/tcp                    ALLOW       Anywhere

If you have a service like MySQL that should only be accessible from within the network, instead of opening the port to everyone, use sudo ufw allow from 192.168.1.0/24 to any port 3306.

Restrict SSH port access

To further enhance Linux server security, you can restrict access to port 22 to only your own IP:

sudo ufw allow from YOUR_IP to any port 22 proto tcp

If your IP is not static, do not do this; instead, use fail2ban, which we explain in the next section.

3. Enable automatic security updates

Many successful attacks exploit vulnerabilities that were patched months ago. Automatic security updates close this gap without requiring you to check logs every day.

Install and configure unattended-upgrades

On Ubuntu, this tool is usually pre-installed. If not, install it:

sudo apt update
sudo apt install unattended-upgrades

Then edit the configuration file:

sudo dpkg-reconfigure --priority=low unattended-upgrades

Select Yes in the dialog that appears. For more detailed settings, open /etc/apt/apt.conf.d/50unattended-upgrades and make sure the following line is active:

Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
};

This setting only installs security updates and prevents automatic installation of new packages that could break the system. To verify the service is working correctly, check its log:

sudo tail -f /var/log/unattended-upgrades/unattended-upgrades.log

4. Install and configure fail2ban to protect against brute-force attacks

Even with password login disabled, services like SSH and web servers may still be exposed to attacks. fail2ban is an open-source tool that monitors logs and temporarily blocks IPs with suspicious behavior.

Basic installation and setup

sudo apt install fail2ban

Instead of editing the main configuration file, create a local file that takes priority:

sudo nano /etc/fail2ban/jail.local

Add the following content:

[sshd]
enabled = true
port = ssh
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600
findtime = 600

These settings mean that if there are three failed login attempts (maxretry) within 10 minutes (findtime), your IP will be blocked for one hour (bantime). After saving the file, restart the service:

sudo systemctl restart fail2ban
sudo systemctl enable fail2ban

Check status and advanced settings

To see the list of blocked IPs:

sudo fail2ban-client status sshd

The output includes the number of blocked IPs and their list. If you have an nginx web server, you can create a similar jail for it:

[nginx-http-auth]
enabled = true
port = http,https
filter = nginx-http-auth
logpath = /var/log/nginx/error.log
maxretry = 5
bantime = 1800

Ready-made filters are located in the /etc/fail2ban/filter.d/ directory, and you can also create jails for services like Postfix or ProFTPD.

5. Final checks and additional tips

After completing these steps, perform a few final checks to make sure everything is working correctly.

Test Linux server security from outside

Use a port scanning tool like nmap on your local system:

nmap -sS -p- your-server-ip

This command shows all open ports. If a port is open that should not be, check the firewall. You can also use online services like ssh-audit.com to check the security of your SSH configuration.

Enable automatic updates and monitoring

To stay informed about your server's status, set up a simple script to send an email on successful logins. Create the file /etc/ssh/sshrc:

#!/bin/sh
echo "SSH login on $(hostname) at $(date)" | mail -s "SSH Login Alert" your@email.com

And make it executable:

sudo chmod +x /etc/ssh/sshrc

This simple method helps you stay aware of any unexpected logins.

Summary

This is a basic checklist for securing a fresh Linux server, but security is an ongoing process. Review logs monthly, install updates, and use tools like lynis for security audits. If you are looking for a reliable platform to implement these settings, ServerNet cloud servers with full SSH access and a Linux kernel allow you to implement these exact steps precisely. But the most important point is to never delay these settings — the first hours after installation are the most critical time for your server's security.