← Back to Security

How to Harden a Linux Server: Security Checklist 2026

A hardened Linux server blocks unauthorized access, limits privilege escalation, and reduces attack surface. Start with SSH key authentication, disable root login, configure a firewall, apply updates regularly, and audit user permissions—these five steps eliminate 80% of common vulnerabilities.

Why Linux Server Hardening Matters Now

Linux powers 96% of cloud infrastructure. It's also the most targeted platform for automated attacks. Unpatched servers get compromised within hours of going online. The average breach costs organizations $4.5 million, but most breaches exploit known vulnerabilities that hardening prevents.

2026's threat landscape demands zero-trust architecture and continuous vulnerability scanning. You can't rely on defaults anymore. Every exposed port, every weak credential, every outdated package is a liability.

1. Secure SSH Access First

SSH is your primary attack vector. Attackers run 24/7 brute-force attempts against port 22. Most compromised Linux servers fell through weak SSH configuration, not sophisticated exploits.

Disable Password Authentication

Switch to key-based authentication exclusively. Generate a strong key pair:

ssh-keygen -t ed25519 -C "[email protected]" -f ~/.ssh/id_ed25519

Copy the public key to your server:

ssh-copy-id -i ~/.ssh/id_ed25519.pub user@server_ip

Then edit /etc/ssh/sshd_config:

PasswordAuthentication no
PubkeyAuthentication yes
PermitRootLogin no
X11Forwarding no
MaxAuthTries 3
MaxSessions 5

Apply changes:

sudo systemctl restart ssh

Change the Default SSH Port

Port 22 attracts 90% of automated scans. Move SSH to a non-standard port (avoid common ones like 2222):

Port 2048

Update your firewall rules and client config accordingly.

Implement SSH Rate Limiting

Use ufw to limit connection attempts:

sudo ufw limit 2048/tcp

Or configure Fail2Ban to auto-block IPs after failed attempts:

sudo apt install fail2ban
sudo systemctl enable fail2ban

2. Implement Host-Based Firewall

A firewall enforces explicit allow rules, blocking everything by default. UFW (Uncomplicated Firewall) is straightforward for single-server setups.

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 2048/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable

Check status:

sudo ufw status verbose

Only open ports you actually use. Every exposed port increases attack surface.

3. Keep Systems Updated and Patched

Unpatched systems are compromised systems. Enable automatic security updates:

sudo apt install unattended-upgrades
sudo dpkg-reconfigure -plow unattended-upgrades

Verify it's running:

sudo systemctl status unattended-upgrades

Check for updates manually:

sudo apt update
sudo apt upgrade
sudo apt full-upgrade

Set a cron job for weekly security audits:

0 2 * * 0 /usr/bin/apt update && /usr/bin/apt upgrade -y

4. Manage User Accounts and Permissions

Principle of least privilege means users get only what they need. Remove unnecessary accounts and audit sudoers:

sudo visudo

Only grant sudo access when absolutely necessary. Check active user accounts:

cat /etc/passwd | grep -E ':(0|[1-9][0-9]{2,}):' | cut -d: -f1

Disable unused accounts:

sudo usermod -L username

Set strong password policies in /etc/login.defs:

PASS_MAX_DAYS   90
PASS_MIN_DAYS   1
PASS_WARN_AGE   7
PASS_MIN_LEN    16

5. Configure Mandatory Access Controls

SELinux (Security-Enhanced Linux) or AppArmor add kernel-level access controls. Most cloud images come with these disabled for simplicity, but you should enable them.

Check current status:

getenforce

For AppArmor (Ubuntu/Debian):

sudo systemctl status apparmor
sudo aa-enforce /etc/apparmor.d/usr.sbin.sshd

For SELinux (RHEL/CentOS):

getenforce
semanage login -l

6. Disable Unnecessary Services

Every running service is potential attack surface. List active services:

sudo systemctl list-units --type=service --state=running

Disable services you don't use:

sudo systemctl disable avahi-daemon
sudo systemctl stop avahi-daemon

Common candidates for removal: telnet, FTP, X11, Bluetooth, cups (unless printing is needed).

7. Enable System Auditing

Auditd logs system-level events for forensics and compliance:

sudo apt install auditd
sudo systemctl enable auditd
sudo systemctl start auditd

Add audit rules to /etc/audit/rules.d/audit.rules:

-w /etc/sudoers -p wa -k sudoers_changes
-w /etc/shadow -p wa -k shadow_changes
-a always,exit -F arch=b64 -S adjtimex -F auid>=1000 -F auid!=-1 -k time_change

View logs:

sudo ausearch -k sudoers_changes

8. Configure Log Management

Centralize logs to prevent tampering and aid investigation. Install rsyslog:

sudo apt install rsyslog
sudo systemctl enable rsyslog

Forward sensitive logs to a remote syslog server:

*.* @@remote_host:514

Set appropriate log rotation to prevent disk filling:

/var/log/auth.log
{
    weekly
    rotate 12
    compress
    delaycompress
    missingok
    notifempty
}

9. Harden Kernel Parameters

Tune kernel settings in /etc/sysctl.conf for defense against network attacks:

# Disable IP forwarding (unless router)
net.ipv4.ip_forward = 0

# Enable SYN flood protection
net.ipv4.tcp_syncookies = 1

# Disable ICMP redirects
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.default.send_redirects = 0

# Enable bad error message protection
net.ipv4.icmp_ignore_bogus_error_responses = 1

# Enable Reverse Path Filtering
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

Apply:

sudo sysctl -p

10. Regular Security Audits and Vulnerability Scanning

Hardening isn't one-time—it requires continuous monitoring. Schedule regular security scans:

sudo apt install lynis
sudo lynis audit system

Check for open ports regularly:

sudo ss -tlnp

Review failed SSH attempts:

grep "Failed password" /var/log/auth.log | wc -l

Set up monitoring dashboards using tools like Prometheus and Grafana for real-time visibility.

Hardening Checklist Summary

• ✓ Generate and deploy SSH keys; disable password auth
• ✓ Change SSH port from 22; rate-limit connection attempts
• ✓ Configure host firewall with UFW (deny all, allow specific)
• ✓ Enable automatic security updates (unattended-upgrades)
• ✓ Remove unused user accounts; enforce password policy
• ✓ Enable SELinux or AppArmor for MAC
• ✓ Disable unnecessary services and daemons
• ✓ Install and configure auditd for logging
• ✓ Centralize logs; rotate and archive appropriately
• ✓ Harden kernel parameters for network defense
• ✓ Run periodic audits with Lynis
• ✓ Monitor failed logins and suspicious activity

Tools and Resources

Use these tools to validate hardening:

• Lynis: Security auditing framework for Unix/Linux
• Fail2Ban: Intrusion prevention by rate-limiting
• OpenSCAP: Compliance scanning against NIST/CIS benchmarks
• Tigertail: Configuration management and drift detection
• Systemd Security Suite: Service hardening and isolation

Next Steps

Hardening is iterative. Start with SSH keys and firewall rules, then progressively enable auditing and MAC. Test changes in development first. Document your configurations in version control. Schedule quarterly audits using vulnerability scanning tools and keep kernel and packages updated.

Consider compliance requirements—PCI DSS, HIPAA, and SOC 2 all mandate hardening practices. The checklist above aligns with CIS Linux Benchmarks 2026 standards.