Securing a Linux server has never been more importan than ever these days..
With automated attacks, AI-driven exploits, and increasingly complex infrastructure, even a small misconfiguration can lead to a serious breach.
But wait, you don't have to wait to get bumped by a random script kiddie. Good news is you can mitigate a bit attacks with just a few practical and pretty much standard steps, that can can drastically increase your server’s security.
Below is a straightforward, battle-tested hardening guide suitable for Debian, Ubuntu, CentOS, AlmaLinux, and most modern distributions.
1. Keep the System Updated (But Safely)
Outdated packages remain the #1 cause of server compromises.
On Debian/Ubuntu:
# apt update && apt upgrade -y
# apt install unattended-upgrades
On RHEL-based systems:
# dnf update -y
# dnf install dnf-automatic
Enable security-only auto-updates where possible. Full auto-updates may break production apps, so use them carefully.
2. Create a Non-Root User and Disable Direct Root Login
Attackers constantly brute-force “root”. Avoid letting them.
# adduser sysadmin
# usermod -aG sudo sysadmin
Then edit SSH:
# vim /etc/ssh/sshd_config
Set:
PermitRootLogin no
PasswordAuthentication no
And restart:
# systemctl restart sshd
Use SSH keys only.
3. Install a Firewall and Block Everything by Default
UFW (Debian/Ubuntu):
# ufw default deny incoming
# ufw default allow outgoing
#ufw allow ssh
# ufw enable
Firewalld (RHEL/AlmaLinux):
# systemctl enable firewalld –now
# firewall-cmd –permanent –add-service=ssh
# firewall-cmd –reload
Turn off any unneeded ports immediately.
4. Protect SSH with Fail2Ban
Fail2Ban watches log files for suspicious authentication attempts and blocks offenders.
# apt install fail2ban -y
or
# dnf install fail2ban -y
Enable:
# systemctl enable –now fail2ban
To harden SSH jail:
[sshd]
enabled = true
maxretry = 5
bantime = 1h
findtime = 10m
5. Enable Kernel Hardening
Install sysctl rules that protect against common attacks:
Create /etc/sysctl.d/99-hardening.conf:
kernel.kptr_restrict = 2
kernel.sysrq = 0
net.ipv4.conf.all.rp_filter = 1
net.ipv4.tcp_synack_retries = 2
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.log_martians = 1
Apply:
# sysctl –system
6. Install and Configure AppArmor or SELinux
Mandatory Access Control significantly limits damage if a service gets compromised.
- Ubuntu / Debian uses AppArmor by default — ensure it's enabled.
- RHEL, AlmaLinux, Rocky use SELinux — keep it in enforcing mode unless absolutely necessary.
Check SELinux:
# getenforce
You want:
Enforcing but hopefully you will have to configure all your machine services to venerate and work correctly with selinux enabled.
7. Scan the System with Lynis
Lynis is the best open-source Linux security auditing tool.
# apt install lynis
# lynis audit system
It provides a security score and actionable suggestions.
8. Use 2FA for SSH (Optional but Highly Recommended)
Use Two Factor Authentication:
a. Freely with Oath toolkit – you can read how in my previous article how to set up 2fa free software authentication on Linux
or
b. Install Google Authenticator:
# apt install libpam-google-authenticator
# google-authenticator
Enable in /etc/pam.d/sshd:
auth required pam_google_authenticator.so
And in SSH config:
ChallengeResponseAuthentication yes
Restart SSH.
9. Separate Services Using Containers or Systemd Isolation
Even simple servers can benefit from isolation.
Systemd sandbox options:
ProtectSystem=full
ProtectHome=true
ProtectKernelTunables=true
PrivateTmp=true
Add these inside a service file under:
/etc/systemd/system/yourservice.service
It prevents processes from touching parts of the system they shouldn’t.
10. Regular Backups Are Part of Security
A secure server with no backups is a disaster waiting to happen.
Use:
- rsync
- borgbackup
- restic
- Cloud object storage with versioning
Always encrypt backups and test restore procedures.
Conclusion
Hardening a Linux server in 2025 requires vigilance, good practices, and layered security. No single tool will protect your system — but when you combine SSH security, firewalls, Fail2Ban, kernel hardening, and backups, you eliminate the majority of attack vectors.
