Every Linux server exposed to the internet is a target. Here are 10 hardening steps we implement on every server we manage at Maxora.
1. Disable Root Login & Use SSH Keys
Set `PermitRootLogin no` and `PasswordAuthentication no` in sshd_config. Use ed25519 SSH keys exclusively.
2. Configure a Firewall (iptables/nftables/firewalld)
Default deny all inbound. Explicitly allow only required ports. Use connection tracking for stateful rules.
3. Keep the System Updated
Enable automatic security updates (unattended-upgrades on Debian/Ubuntu, dnf-automatic on RHEL). Test patches in staging first.
4. Use SELinux or AppArmor
Don't disable SELinux. Learn to write policies. Mandatory Access Control is your last line of defense when a service gets compromised.
5. Audit User Accounts and Permissions
Remove unnecessary accounts. Use sudo with specific command allowlists, not blanket ALL. Audit /etc/sudoers regularly.
6. Enable Auditd Logging
Configure auditd to log privileged operations, file modifications to sensitive paths, and authentication events. Ship logs to a central SIEM.
7. Harden the Kernel
Set sysctl parameters: disable IP forwarding (if not a router), enable TCP SYN cookies, restrict core dumps, and randomize memory layout (ASLR).
8. Remove Unnecessary Packages and Services
Every installed package is attack surface. Uninstall what you don't need. Disable unused systemd services.
9. Implement Fail2ban
Protect SSH, web servers, and mail servers from brute-force attacks. Configure appropriate ban times and whitelist your own IPs.
10. Encrypt Data at Rest and in Transit
Use LUKS for disk encryption, TLS for all network services, and encrypted backups. There is no excuse for unencrypted data in 2026.
