The first hour on a new Linux server: my hardening checklist

A new server on the internet gets scanned within minutes. This is what I do in the first hour, before anything is deployed. Commands are for Debian/Ubuntu, with RHEL-family equivalents where they differ.

1. Update everything

sudo apt update && sudo apt full-upgrade -y     # RHEL: sudo dnf upgrade -y

2. A named admin user with an SSH key

sudo adduser ameer
sudo usermod -aG sudo ameer          # RHEL: wheel
sudo -u ameer mkdir -m 700 /home/ameer/.ssh
# paste the public key into /home/ameer/.ssh/authorized_keys (mode 600)

Log in as that user in a second terminal and confirm sudo works before you change SSH. Keep the first session open until you're sure.

3. Lock down SSH

In /etc/ssh/sshd_config (or a file in sshd_config.d/):

PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
MaxAuthTries 3

sudo sshd -t && sudo systemctl reload ssh       # RHEL: sshd

4. Default-deny firewall

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow OpenSSH
sudo ufw enable                                   # RHEL: firewalld

Open only what the server is for. If SSH only needs to be reachable from the office or a VPN, restrict it to that source address.

5. Slow down brute force

sudo apt install fail2ban -y

The default sshd jail is a good start. Key-only SSH already stops password guessing, so fail2ban mainly keeps the logs quiet.

6. Automatic security updates

sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure -plow unattended-upgrades   # RHEL: dnf-automatic

7. Remove what you don't need

ss -tulpn
systemctl list-unit-files --state=enabled

Every listening port is something to defend. If you don't know why it's there, find out, then disable it.

8. Time and logs

timedatectl set-timezone Asia/Karachi            # or UTC; be consistent
timedatectl status                                 # NTP synchronized: yes

Correct time matters more than people think. Logs from different servers are useless if their clocks disagree. Ship logs off the box (Loki, Graylog or plain rsyslog) so an attacker can't quietly delete them.

9. Check from the outside

Finally, scan it like an attacker would, from another machine:

nmap -Pn -sV your.server.ip

If anything is open that you didn't expect, go back to step 7.

Written by Ameer Hamza, Linux systems engineer in Lahore. Need help with something like this? Get in touch.