Hardening isn’t one big action, it’s a series of small defaults that close off the easy wins for an attacker. Here’s a practical checklist for a fresh Linux server, roughly in order of impact.

01 — SSH first

SSH is usually the first exposed service. Disable root login, prefer key-based authentication, and consider moving away from the default port to reduce automated scanning noise.

PermitRootLogin no
PasswordAuthentication no
Port 2222

Pair this with fail2ban so repeated failed attempts are handled automatically.

02 — Least privilege

• Create a dedicated non-root user for deployments and administration
• Use sudo with scoped permissions
• Review /etc/sudoers for broad NOPASSWD entries

03 — Firewall and exposed services

Default-deny inbound traffic and explicitly allow only what is required.

ufw default deny incoming
ufw allow 2222/tcp
ufw allow 443/tcp
ufw enable

04 — Patch cadence

Automated security updates are valuable on most workloads. The goal is to reduce the window in which known vulnerabilities remain exploitable.

05 — Visibility

Use auditd and centralized logging where appropriate so privilege changes, sensitive file access and suspicious activity can be investigated with useful timestamps and context.