Linux server hardening checklist for a new VPS or dedicated server

A freshly installed server starts receiving automated login attempts within minutes of going online. Linux server hardening means reducing what attackers can reach and making the rest hard to break. Work through this checklist on every new VPS or dedicated server before you put real data on it.

Before you start

• Root SSH access and a way back in if you lock yourself out (the provider's VNC/console or rescue mode).
• Commands are shown for Ubuntu/Debian (apt) and AlmaLinux/Rocky (dnf).

Update the system

apt update && apt full-upgrade -y

or

dnf upgrade -y

Reboot if a new kernel was installed.

Create a sudo user

1. Create the user: adduser deploy (on AlmaLinux use useradd -m deploy && passwd deploy).
2. Give it sudo: usermod -aG sudo deploy on Ubuntu or usermod -aG wheel deploy on AlmaLinux.

Use SSH keys and lock down SSH

1. From your computer copy your public key: ssh-copy-id deploy@your-server-ip.
2. Test key login in a new window.
3. In /etc/ssh/sshd_config (or a file in /etc/ssh/sshd_config.d/) set:
   Copy

   PermitRootLogin no
   PasswordAuthentication no
   KbdInteractiveAuthentication no
   MaxAuthTries 3

4. Check and restart: sshd -t && systemctl restart ssh (the service is sshd on AlmaLinux).

Enable a firewall

Allow only what you serve. On Ubuntu with UFW:

ufw default deny incoming
ufw allow OpenSSH
ufw allow 80,443/tcp
ufw enable

On AlmaLinux with firewalld:

firewall-cmd --permanent --add-service=ssh --add-service=http --add-service=https
firewall-cmd --reload

On cPanel servers use CSF instead of UFW or firewalld.

Block brute-force attempts

Install Fail2Ban (apt install fail2ban or dnf install epel-release fail2ban), then enable the SSH jail in /etc/fail2ban/jail.local:

[sshd]
enabled = true
maxretry = 5
bantime = 1h

Start it with systemctl enable --now fail2ban and check with fail2ban-client status sshd.

Turn on automatic security updates

• Ubuntu/Debian: apt install unattended-upgrades && dpkg-reconfigure -plow unattended-upgrades.
• AlmaLinux/Rocky: dnf install dnf-automatic, set upgrade_type = security and apply_updates = yes in /etc/dnf/automatic.conf, then systemctl enable --now dnf-automatic.timer.

Close services you do not need

1. List listening ports: ss -tulpn.
2. Disable anything unused: systemctl disable --now servicename.
3. Bind databases and caches (MySQL, Redis, Memcached) to 127.0.0.1 unless another server must reach them.

Protect logs, time and backups

• Keep time accurate with timedatectl set-ntp true so logs and certificates line up.
• Review authentication logs: journalctl -u ssh or /var/log/secure.
• Set up automated, off-server backups and test a restore.
• Keep SELinux enforcing on RHEL-family systems instead of disabling it.

What to check afterwards

• Root login and password login are refused.
• An external port scan (for example nmap your-server-ip from another machine) shows only the ports you intend.
• Fail2Ban is banning repeat offenders.

FAQ: Linux server hardening

Should I change the SSH port?

It reduces log noise from bots but is not real security. Keys, no root login and Fail2Ban matter far more.

Is a firewall needed if only a few services run?

Yes. It protects you if a service you forgot about starts listening later.

How often should I review a hardened server?

Check updates and logs weekly and review users, open ports and backups at least monthly.

Next steps

• SSH lockdown checklist
• What is a firewall?
• SELinux basics on AlmaLinux and Rocky
• Install and configure CSF on WHM