✉ support@coreserversupport.com

Introduction

Securing a Linux server is critical to protecting your business from automated brute-force attacks, unauthorized access, data breaches, and malware. Whether you are running Ubuntu, Debian, AlmaLinux, or Rocky Linux, deploying default installations leaves standard ports open to continuous network scans.

In this guide, we will cover 10 essential Linux server hardening steps to secure your server infrastructure and prevent unauthorized entry.

Step 1: Update Your Server Packages

Outdated packages contain known vulnerabilities that attackers can exploit easily. Run regular system updates:

• Ubuntu / Debian:Bashsudo apt update && sudo apt upgrade -y
• RHEL / AlmaLinux / Rocky Linux:Bashsudo dnf update -y

Step 2: Disable Root Login via SSH

Logging into a server directly as root gives full system access without an audit trail. Create a dedicated non-root user with administrative privileges instead.

1. Create a new user and add them to the sudo group:Bashadduser appuser usermod -aG sudo appuser
2. Disable root login in SSH configuration (/etc/ssh/sshd_config):PlaintextPermitRootLogin no

Step 3: Enforce SSH Key Authentication

Disable password authentication entirely to prevent brute-force login attempts.

1. Generate an SSH key pair on your local machine:Bashssh-keygen -t ed25519
2. Copy the public key to your Linux server:Bashssh-copy-id appuser@YOUR_SERVER_IP
3. In /etc/ssh/sshd_config, disable password logins:PlaintextPasswordAuthentication no
4. Reload the SSH daemon:Bashsudo systemctl reload sshd

Step 4: Change the Default SSH Port

Automated bots continuously scan port 22 for SSH targets. Changing your SSH port reduces random scan noise significantly.

1. Open /etc/ssh/sshd_config and change Port 22 to a high-range port (e.g., 2288):PlaintextPort 2288
2. Ensure your firewall allows traffic on the new port before restarting SSH!

Step 5: Configure a Firewall (UFW or Firewalld)

Only open network ports that are actively required for your services (e.g., HTTP/HTTPS and your custom SSH port).

• For UFW (Ubuntu/Debian):Bashsudo ufw default deny incoming sudo ufw default allow outgoing sudo ufw allow 2288/tcp sudo ufw allow 80/tcp sudo ufw allow 443/tcp sudo ufw enable
• For Firewalld (RHEL/CentOS/AlmaLinux):Bashsudo firewall-cmd --permanent --add-port=2288/tcp sudo firewall-cmd --permanent --add-service=http sudo firewall-cmd --permanent --add-service=https sudo firewall-cmd --reload

Step 6: Install Fail2ban to Block Brute-Force Attacks

Fail2ban monitors login logs and automatically blocks IP addresses showing suspicious activity (like too many failed password attempts).

1. Install Fail2ban:Bashsudo apt install fail2ban -y # Ubuntu/Debian sudo dnf install fail2ban -y # RHEL/AlmaLinux
2. Enable and start the service:Bashsudo systemctl enable --now fail2ban

Step 7: Remove Unused Services & Open Ports

Unnecessary background services increase your attack surface. Check active listening ports with:

Bash

ss -tulpn

Stop and disable any service you do not recognize or require:

Bash

sudo systemctl stop service_name
sudo systemctl disable service_name

Step 8: Set Up Automated Security Updates

Ensure critical security patches apply automatically so your system stays protected against zero-day exploits.

• On Ubuntu/Debian: Install unattended-upgrades:Bashsudo apt install unattended-upgrades -y sudo dpkg-reconfigure --priority=low unattended-upgrades
• On RHEL/AlmaLinux: Enable dnf-automatic:Bashsudo dnf install dnf-automatic -y

Step 9: Enforce Strict File Permissions

Ensure world-writable permissions are removed and sensitive files like /etc/shadow and /etc/passwd are properly restricted.

• Protect SSH directory:Bashchmod 700 ~/.ssh chmod 600 ~/.ssh/authorized_keys

Step 10: Enable Monitoring & Log Auditing

Regularly check /var/log/auth.log (Debian/Ubuntu) or /var/log/secure (RHEL/AlmaLinux) for unauthorized access attempts.

Using proactive server monitoring tools like Nagios, Zabbix, or Datadog alerts your engineering team instantly when unexpected activity or CPU spikes occur.

Need Help Securing Your Cloud Infrastructure?

Server security requires ongoing vigilance and audit updates. At CoreServerSupport, our certified Linux administrators provide 24/7 server monitoring, firewall configuration, automated backup management, and routine security audits to keep your infrastructure safe.

Contact CoreServerSupport Todayfor a free security audit!