Skip to main content
To harden a Linux server, work through these steps in order: install all updates and turn on automatic security updates, create a sudo user, log in with SSH keys, disable root and password logins, enable a firewall that only allows the ports you use, add Fail2Ban or CrowdSec, take regular off-server backups, and audit the result with sudo lynis audit system. Each step links to a full guide.

​
Before you start

  • You need root access or a user with sudo. Commands below use sudo; if you are logged in as root you can leave it out.
  • Take a snapshot or backup before you change SSH or the firewall. See schedule and restore backups.
  • Know how to reach your server if SSH stops working. On a VPS use the VNC console or rescue mode. On a dedicated server, open a ticket if you need console access.
  • Use a supported release. Ubuntu 18.04 / 20.04, Debian 10 / 11 and CentOS 7 / Stream 8 no longer get regular security updates. Rebuild on a current release instead of hardening an old one.
Change SSH and firewall settings one at a time. After each change, open a second SSH session and log in before you close the first one. If the new login fails, you can still undo the change from the session that is open.

​
What should a Linux server hardening checklist include?

​
How to harden SSH quickly

SSH is the service attackers target most. Once your key login works, put your SSH settings in one drop-in file. A drop-in file is a small file in /etc/ssh/sshd_config.d/ that the main config reads first.
1

Confirm your key login works

Log in with your SSH key as your sudo user, not as root. Keep this session open.
2

Create the drop-in file

Add these lines and replace alex with your user name:
3

Test the configuration

No output means the syntax is valid.
4

Restart SSH

5

Test from a second session

Open a new terminal and log in again. Close the first session only when this works.
sshd uses the first value it finds for each setting, so a file in sshd_config.d/ overrides the same setting further down in /etc/ssh/sshd_config (sshd_config manual).

​
Which firewall should I use?

If you use Docker, read the note about published ports in the UFW guide first. You can also filter traffic before it reaches your VPS in the firewall panel.

​
How to check which services are listening

Every program that listens on a public address can be reached from the internet unless your firewall blocks it.
Example output:
127.0.0.1 means only the server itself can connect. 0.0.0.0 or [::] means every network interface. Stop and disable services you do not use:

​
How to audit your server with Lynis

Lynis is a free auditing tool that checks hundreds of settings and gives you a hardening score with suggestions.
Read the Warnings and Suggestions at the end of the report. Fix warnings first. Not every suggestion fits every server, so skip ones that would break a service you need.

​
How to keep the server secure after setup

  • Weekly: check sudo lynis audit system or your update logs, and review recent logins with last.
  • Monthly: test a restore from your backup and remove users and SSH keys you no longer need.
  • After any change: re-run sudo ss -tulpn and confirm only the expected ports are open.

​
Frequently asked questions

​
Is a firewall enough to secure a Linux server?

No. A firewall only controls which ports are reachable. You still need updates, key-only SSH logins and backups, because attackers use the services you deliberately leave open.

​
Should I change the SSH port?

It reduces log noise from bots but does not stop a targeted attacker. Key-only logins and Fail2Ban or CrowdSec give more protection. See change the SSH port if you still want to.

​
Do I need antivirus on a Linux server?

Most Linux servers do not run a real-time antivirus. A scheduled scan with ClamAV is useful on servers that store user uploads or email. See scan a Linux server for malware.

​
Should I disable SELinux on AlmaLinux or Rocky?

No. Keep it in enforcing mode and fix the label or boolean the error points to. See use SELinux.

​
What should I do if I think my server is already hacked?

Do not keep hardening a server you no longer trust. Follow what to do if your Linux server is hacked.

VPS and dedicated server guides

Every guide in this section.

First 10 things on a new VPS

Set up a new Linux server step by step.

Set up UFW

Firewall for Ubuntu and Debian.

Set up Fail2Ban

Block SSH brute-force attacks.

Disable root login

Stop direct root logins over SSH.

Server hacked?

Steps to recover safely.
Checked against the official sshd_config manual, Ubuntu Server firewall documentation and Red Hat firewalld documentation on 4 November 2026; the SSH drop-in file (sshd -t) and lynis audit system were tested on Ubuntu 24.04 LTS. Commands can differ on other distributions or releases.

​
Need Extra Help?

If you encounter any issues, our support team is ready to assist:

​
Save on Your Hosting

Ready to upgrade your hosting? Use code KB20 at checkout for 20% off your first order!
Last Updated: November 2026