A freshly deployed Linux server is a clean slate, and the first hours after setup are the best time to lock it down. Hardening is the process of reducing your attack surface before anyone tries to exploit it. This checklist walks through the essential steps to secure a new server.
Start with Updates
The very first thing to do is apply all available security updates. A fresh install often ships with packages that already have known vulnerabilities, so patching immediately closes the most obvious holes. Enabling automatic security updates keeps you protected as new fixes are released.
Lock Down SSH Access
SSH is the front door to your server, and it deserves the most attention. Disable root login, switch from passwords to SSH keys, and consider changing the default port to cut down on automated noise. Where possible, restrict SSH access to known IP addresses so only trusted networks can even attempt to connect.
Create a Non-Root User
Working as root all the time is risky because a single mistake can damage the whole system. Create a regular user account with sudo privileges and use that for daily administration. This limits the blast radius of errors and makes your activity easier to audit.
Configure a Firewall
Set up a host firewall with a default-deny policy and open only the ports your services genuinely need. Most servers only require a handful of ports, so closing everything else dramatically shrinks what an attacker can reach. Review the rules whenever you add or remove a service.
Essential Hardening Steps
Beyond the basics, a few more measures make a big difference:
- Install and configure a tool like Fail2ban to block repeated failed login attempts.
- Remove unused packages and services to reduce what is running and exposed.
- Enforce strong password policies for any account that still uses passwords.
- Enable detailed logging and review it regularly for unusual activity.
- Set up automatic, tested backups so you can recover from any incident.
Monitor and Maintain
Hardening is not a one-time task. Keep packages updated, watch your logs, and periodically review your firewall rules and user accounts. Security is an ongoing process, and a server that was locked down months ago can drift if it is not maintained.
How Noded Can Help
Whether you want a securely configured server from day one or help auditing an existing one, we can guide you through sensible hardening with safe defaults. Tell us what the server will run and who needs access, and we will help you secure it without locking yourself out.
FAQ
What is the most important hardening step?
Securing SSH and keeping the system patched are the two highest-impact steps. SSH is the main remote entry point, and unpatched software is the most common way servers get compromised, so prioritize both.
Should I change the default SSH port?
Changing the port reduces automated scanning noise but is not real security on its own. Pair it with key-based authentication, disabled root login, and IP restrictions for meaningful protection.
Do I need a firewall if my provider has one?
A host firewall adds defense in depth even if a network firewall exists. Running both means a single misconfiguration is less likely to expose your server, which is always safer than relying on one layer.
How often should I review server security?
Apply updates continuously and review accounts, firewall rules, and logs on a regular schedule. Security drifts over time, so periodic reviews catch issues before they become problems.