> ## Documentation Index
> Fetch the complete documentation index at: https://help.freakhosting.com/llms.txt
> Use this file to discover all available pages before exploring further.

# Linux Server Hardening Checklist for Your VPS

> A Linux server hardening checklist for your VPS or dedicated server: updates, a sudo user, SSH keys, no root login, a firewall, Fail2Ban, backups and audits.

To harden a Linux server, work through these steps in order: install all updates and turn on automatic security updates, create a sudo user, log in with SSH keys, disable root and password logins, enable a firewall that only allows the ports you use, add Fail2Ban or CrowdSec, take regular off-server backups, and audit the result with `sudo lynis audit system`. Each step links to a full guide.

| Difficulty | Time | Works on | Needs |
| - | - | - | - |
| Beginner to intermediate | 1–2 hours for the full list | Ubuntu 22.04 / 24.04, Debian 12 / 13, AlmaLinux and Rocky Linux 9 / 10 | Root or sudo access, SSH client |

## Before you start

* You need root access or a user with `sudo`. Commands below use `sudo`; if you are logged in as root you can leave it out.
* Take a snapshot or backup before you change SSH or the firewall. See [schedule and restore backups](https://help.freakhosting.com/portals/vps-panel/how-to-schedule-and-restore-backups.md).
* Know how to reach your server if SSH stops working. On a VPS use the [VNC console](https://help.freakhosting.com/portals/vps-panel/how-to-enable-and-use-vnc-console-access.md) or [rescue mode](https://help.freakhosting.com/portals/vps-panel/how-to-use-rescue-mode.md). On a dedicated server, [open a ticket](https://freakhosting.com/clientarea/submitticket.php) if you need console access.
* Use a supported release. Ubuntu 18.04 / 20.04, Debian 10 / 11 and CentOS 7 / Stream 8 no longer get regular security updates. Rebuild on a current release instead of hardening an old one.

> [!WARNING]
>
> Change SSH and firewall settings one at a time. After each change, open a **second** SSH session and log in before you close the first one. If the new login fails, you can still undo the change from the session that is open.

## What should a Linux server hardening checklist include?

| # | Check | Why it matters | Guide |
| - | - | - | - |
| 1 | All packages updated | Most break-ins use known, already-fixed bugs | [Update Linux packages](https://help.freakhosting.com/portals/other/how-to-update-linux-packages.md) |
| 2 | Automatic security updates on | Fixes arrive even when you forget | [Automatic security updates](https://help.freakhosting.com/portals/other/how-to-enable-automatic-security-updates.md) |
| 3 | A personal sudo user | You stop working as root all day | [Create a sudo user](https://help.freakhosting.com/portals/other/how-to-create-a-sudo-user-on-linux.md) |
| 4 | SSH key login | Keys cannot be guessed like passwords | [Create and use SSH keys](https://help.freakhosting.com/portals/other/how-to-create-and-use-ssh-keys.md) |
| 5 | Root login over SSH off | Bots try `root` first | [Disable root login](https://help.freakhosting.com/portals/other/how-to-disable-root-login-over-ssh.md) |
| 6 | Password login over SSH off | Ends password-guessing attacks | [Disable password login](https://help.freakhosting.com/portals/other/how-to-disable-password-login-for-ssh.md) |
| 7 | Firewall on, only needed ports open | Hides services you did not mean to publish | [UFW](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-ufw.md) or [firewalld](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-firewalld.md) |
| 8 | Brute-force blocking | Bans IPs that keep failing to log in | [Fail2Ban](https://help.freakhosting.com/portals/other/how-to-set-up-fail2ban-for-ssh-on-ubuntu.md) or [CrowdSec](https://help.freakhosting.com/portals/other/how-to-install-crowdsec-on-linux.md) |
| 9 | SELinux left in enforcing mode (AlmaLinux / Rocky) | Limits what a hacked service can touch | [Use SELinux](https://help.freakhosting.com/portals/other/how-to-use-selinux-on-almalinux-and-rocky.md) |
| 10 | Kernel network settings reviewed | Ignores spoofed and redirected packets | [sysctl hardening](https://help.freakhosting.com/portals/other/how-to-secure-shared-memory-and-kernel-settings-with-sysctl.md) |
| 11 | Only needed services listening | Every open port is a way in | [Check open ports](https://help.freakhosting.com/portals/other/how-to-check-open-ports-on-linux.md) |
| 12 | Backups stored off the server | You can recover after a mistake or attack | [Back up a Linux server](https://help.freakhosting.com/portals/other/how-to-back-up-a-linux-server.md) |
| 13 | Logins reviewed regularly | You notice unknown access early | [Check login history](https://help.freakhosting.com/portals/other/how-to-check-who-is-logged-in-and-login-history.md) |
| 14 | Regular audit and malware scan | Finds weak settings you missed | [Scan for malware](https://help.freakhosting.com/portals/other/how-to-scan-a-linux-server-for-malware.md) |

## How to harden SSH quickly

SSH is the service attackers target most. Once your key login works, put your SSH settings in one drop-in file. A drop-in file is a small file in `/etc/ssh/sshd_config.d/` that the main config reads first.

**1. Confirm your key login works**

Log in with your SSH key as your sudo user, not as root. Keep this session open.

**2. Create the drop-in file**

```bash theme={null}
sudo nano /etc/ssh/sshd_config.d/00-hardening.conf
```

Add these lines and replace `alex` with your user name:

```ini theme={null}
PermitRootLogin no
PasswordAuthentication no
KbdInteractiveAuthentication no
MaxAuthTries 3
AllowUsers alex
```

**3. Test the configuration**

```bash theme={null}
sudo sshd -t
```

No output means the syntax is valid.

**4. Restart SSH**

> [tab] Ubuntu / Debian
>
> ```bash theme={null}
> sudo systemctl restart ssh
> ```

> [tab] AlmaLinux / Rocky
>
> ```bash theme={null}
> sudo systemctl restart sshd
> ```

**5. Test from a second session**

Open a new terminal and log in again. Close the first session only when this works.

`sshd` uses the first value it finds for each setting, so a file in `sshd_config.d/` overrides the same setting further down in `/etc/ssh/sshd_config` ([sshd\_config manual](https://manpages.ubuntu.com/manpages/noble/man5/sshd_config.5.html)).

## Which firewall should I use?

| Distribution | Default tool | Allow SSH, then turn on |
| - | - | - |
| Ubuntu | UFW (installed, off by default) | `sudo ufw allow OpenSSH` then `sudo ufw enable` |
| Debian | None. Install UFW or use nftables | `sudo apt install ufw` then as Ubuntu |
| AlmaLinux / Rocky | firewalld (on by default) | `sudo firewall-cmd --permanent --add-service=ssh` then `sudo firewall-cmd --reload` |

If you use Docker, read the note about published ports in the [UFW guide](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-ufw.md) first. You can also filter traffic before it reaches your VPS in the [firewall panel](https://help.freakhosting.com/portals/firewall/firewall-panel-overview.md).

## How to check which services are listening

Every program that listens on a public address can be reached from the internet unless your firewall blocks it.

```bash theme={null}
sudo ss -tulpn
```

Example output:

```text theme={null}
Netid State  Recv-Q Send-Q Local Address:Port  Peer Address:Port Process
tcp   LISTEN 0      4096         0.0.0.0:22         0.0.0.0:*     users:(("sshd",pid=812,fd=3))
tcp   LISTEN 0      80         127.0.0.1:3306       0.0.0.0:*     users:(("mariadbd",pid=901,fd=21))
```

`127.0.0.1` means only the server itself can connect. `0.0.0.0` or `[::]` means every network interface. Stop and disable services you do not use:

```bash theme={null}
sudo systemctl disable --now example.service
```

## How to audit your server with Lynis

Lynis is a free auditing tool that checks hundreds of settings and gives you a hardening score with suggestions.

> [tab] Ubuntu / Debian
>
> ```bash theme={null}
> sudo apt install lynis
> sudo lynis audit system
> ```

> [tab] AlmaLinux / Rocky
>
> Lynis is in the EPEL repository.
>
> ```bash theme={null}
> sudo dnf install epel-release
> sudo dnf install lynis
> sudo lynis audit system
> ```

Read the **Warnings** and **Suggestions** at the end of the report. Fix warnings first. Not every suggestion fits every server, so skip ones that would break a service you need.

## How to keep the server secure after setup

* **Weekly:** check `sudo lynis audit system` or your update logs, and review recent logins with `last`.
* **Monthly:** test a restore from your backup and remove users and SSH keys you no longer need.
* **After any change:** re-run `sudo ss -tulpn` and confirm only the expected ports are open.

## Frequently asked questions

### Is a firewall enough to secure a Linux server?

No. A firewall only controls which ports are reachable. You still need updates, key-only SSH logins and backups, because attackers use the services you deliberately leave open.

### Should I change the SSH port?

It reduces log noise from bots but does not stop a targeted attacker. Key-only logins and Fail2Ban or CrowdSec give more protection. See [change the SSH port](https://help.freakhosting.com/portals/other/how-to-change-the-ssh-port.md) if you still want to.

### Do I need antivirus on a Linux server?

Most Linux servers do not run a real-time antivirus. A scheduled scan with ClamAV is useful on servers that store user uploads or email. See [scan a Linux server for malware](https://help.freakhosting.com/portals/other/how-to-scan-a-linux-server-for-malware.md).

### Should I disable SELinux on AlmaLinux or Rocky?

No. Keep it in enforcing mode and fix the label or boolean the error points to. See [use SELinux](https://help.freakhosting.com/portals/other/how-to-use-selinux-on-almalinux-and-rocky.md).

### What should I do if I think my server is already hacked?

Do not keep hardening a server you no longer trust. Follow [what to do if your Linux server is hacked](https://help.freakhosting.com/portals/other/what-to-do-if-your-linux-server-is-hacked.md).

## Related guides

> [card] [VPS and dedicated server guides](https://help.freakhosting.com/portals/other/vps-and-dedicated-server-guides.md)
>
> Every guide in this section.

> [card] [First 10 things on a new VPS](https://help.freakhosting.com/portals/other/first-10-things-to-do-on-a-new-linux-vps.md)
>
> Set up a new Linux server step by step.

> [card] [Set up UFW](https://help.freakhosting.com/portals/other/how-to-set-up-a-firewall-with-ufw.md)
>
> Firewall for Ubuntu and Debian.

> [card] [Set up Fail2Ban](https://help.freakhosting.com/portals/other/how-to-set-up-fail2ban-for-ssh-on-ubuntu.md)
>
> Block SSH brute-force attacks.

> [card] [Disable root login](https://help.freakhosting.com/portals/other/how-to-disable-root-login-over-ssh.md)
>
> Stop direct root logins over SSH.

> [card] [Server hacked?](https://help.freakhosting.com/portals/other/what-to-do-if-your-linux-server-is-hacked.md)
>
> Steps to recover safely.

***

> [!NOTE]
>
> **Checked against the official [sshd\_config manual](https://manpages.ubuntu.com/manpages/noble/man5/sshd_config.5.html), [Ubuntu Server firewall documentation](https://ubuntu.com/server/docs/how-to/security/firewalls/) and [Red Hat firewalld documentation](https://docs.redhat.com/en/documentation/red_hat_enterprise_linux/9/html/configuring_firewalls_and_packet_filters/using-and-configuring-firewalld_firewall-packet-filters)** on 4 November 2026; the SSH drop-in file (`sshd -t`) and `lynis audit system` were tested on Ubuntu 24.04 LTS. Commands can differ on other distributions or releases.

> [!NOTE]
>
> ### Need Extra Help?
>
> If you encounter any issues, our support team is ready to assist:
>
> * **Live Chat:** Quick assistance via our website.
> * **Support Ticket:** [Open a Ticket](https://freakhosting.com/clientarea/submitticket.php)
> * **Discord:** [Join our Community](https://discord.gg/freakhosting)
> * **Email:** [support@freakhosting.com](mailto:support@freakhosting.com)

> [!TIP]
>
> ### Save on Your Hosting
>
> Ready to upgrade your hosting? Use code **KB20** at checkout for **20% off** your first order!

***

**Last Updated:** November 2026


This documentation is built and hosted on [Mintlify](https://mintlify.com), a developer documentation platform.