Linux Server Hardening Guide 2025: A Complete Security Checklist

Secure your Linux VPS with this step-by-step hardening guide covering SSH, firewalls, fail2ban, SELinux, auditd, and continuous monitoring.

Server hardening is the process of securing a Linux server by reducing its attack surface. For UK businesses hosting customer data, a properly hardened server is not optional — it's a legal requirement under GDPR and a fundamental trust signal for your users.

This guide provides a comprehensive, step-by-step Linux server hardening checklist that applies to any UK hosting environment.

1. SSH Hardening

SSH is the most common attack vector for Linux servers. Here's how to lock it down:

Disable Root Login

Create a regular user with sudo privileges and disable direct root SSH access:

# Create a user with sudo
adduser admin
usermod -aG sudo admin

# Edit SSH config
sudo nano /etc/ssh/sshd_config

# Set these values:
PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
AllowUsers admin

Use SSH Key Authentication Only

Generate a strong Ed25519 key pair (more secure than RSA):

# On your local machine
ssh-keygen -t ed25519 -a 256

# Copy to server
ssh-copy-id -i ~/.ssh/id_ed25519.pub admin@your-server

Change the Default SSH Port

Changing from port 22 to a non-standard port reduces automated attacks by 90%:

# In /etc/ssh/sshd_config
Port 2222

# Update firewall rules
sudo ufw allow 2222/tcp
sudo systemctl restart sshd

2. Firewall Configuration (UFW)

A properly configured firewall is your first line of defence. For a typical web server, you only need to allow traffic on specific ports:

# Reset and configure UFW
sudo ufw --force reset
sudo ufw default deny incoming
sudo ufw default allow outgoing

# Allow essential services
sudo ufw allow 2222/tcp      # SSH (custom port)
sudo ufw allow 80/tcp         # HTTP
sudo ufw allow 443/tcp        # HTTPS

# Enable the firewall
sudo ufw --force enable
sudo ufw status verbose

Advanced: Rate Limiting

Protect against brute force and DDoS attacks with rate limiting:

# In /etc/ufw/before.rules, add before *filter:
-A ufw-before-input -p tcp --dport 2222 -m state --state NEW -m recent --set
-A ufw-before-input -p tcp --dport 2222 -m state --state NEW -m recent --update --seconds 60 --hitcount 4 -j DROP

3. Fail2Ban Installation and Configuration

Fail2Ban monitors log files for suspicious activity and automatically bans IPs that show malicious behaviour. It's essential for any internet-facing server.

# Install fail2ban
sudo apt install fail2ban -y

# Create local config
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

Configure jails for common services in /etc/fail2ban/jail.local:

[sshd]
enabled = true
port = 2222
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
bantime = 3600
findtime = 600

[nginx-http-auth]
enabled = true
port = http,https
filter = nginx-http-auth
logpath = /var/log/nginx/error.log
maxretry = 5
bantime = 3600

[wordpress]
enabled = true
filter = wordpress
logpath = /var/log/nginx/access.log
maxretry = 10
bantime = 7200

sudo systemctl restart fail2ban
sudo fail2ban-client status

4. Automatic Security Updates

Unpatched software is the leading cause of server compromises. Configure automatic updates:

# Install unattended-upgrades
sudo apt install unattended-upgrades -y
sudo dpkg-reconfigure --priority=low unattended-upgrades

# Configure updates
sudo nano /etc/apt/apt.conf.d/50unattended-upgrades

# Ensure these lines are uncommented:
Unattended-Upgrade::Allowed-Origins {
    "${distro_id}:${distro_codename}-security";
};
Unattended-Upgrade::AutoFixInterruptedDpkg "true";
Unattended-Upgrade::Remove-Unused-Dependencies "true";

5. SELinux or AppArmor Configuration

Mandatory Access Control (MAC) systems provide an additional security layer beyond standard file permissions. On Ubuntu, use AppArmor. On CentOS/RHEL, use SELinux.

# Check AppArmor status
sudo aa-status

# Install and enable AppArmor utilities
sudo apt install apparmor-utils -y

# Put a profile in enforce mode
sudo aa-enforce /path/to/binary

6. AuditD for System Monitoring

AuditD tracks system calls and file access, essential for compliance and incident response:

# Install auditd
sudo apt install auditd audispd-plugins -y

# Add rules to /etc/audit/rules.d/audit.rules:
-w /etc/passwd -p wa -k identity
-w /etc/shadow -p wa -k identity
-w /etc/ssh/sshd_config -p wa -k sshd_config
-w /var/log/auth.log -p wa -k auth_log
-a always,exit -F arch=b64 -S execve -k process_execution

# Restart auditd
sudo systemctl restart auditd

# Search audit logs
sudo ausearch -k identity --start today

7. File Integrity Monitoring with AIDE

AIDE creates a database of file checksums and alerts when critical system files change:

# Install AIDE
sudo apt install aide -y

# Initialize database
sudo aideinit
sudo mv /var/lib/aide/aide.db.new /var/lib/aide/aide.db

# Configure cron for daily checks
echo "0 4 * * * /usr/bin/aide --check | mail -s 'AIDE Report' admin@hostingowy.com" | crontab -

# Run a manual check
sudo aide --check

8. Network Security and sysctl Hardening

Kernel-level network hardening prevents common network-level attacks:

# In /etc/sysctl.d/99-hardening.conf

# IP Spoofing protection
net.ipv4.conf.all.rp_filter = 1
net.ipv4.conf.default.rp_filter = 1

# Ignore ICMP redirects
net.ipv4.conf.all.accept_redirects = 0
net.ipv6.conf.all.accept_redirects = 0

# Disable source packet routing
net.ipv4.conf.all.accept_source_route = 0
net.ipv6.conf.all.accept_source_route = 0

# SYN flood protection
net.ipv4.tcp_syncookies = 1
net.ipv4.tcp_syn_retries = 2

# Apply settings
sudo sysctl -p /etc/sysctl.d/99-hardening.conf

9. Log Management and Monitoring

Centralised logging is essential for detecting and responding to incidents:

# Configure rsyslog for remote logging
sudo nano /etc/rsyslog.conf

# Add remote log server
*.* @your-log-server:514

# Install logwatch for daily summaries
sudo apt install logwatch -y
sudo logwatch --detail High --mailto admin@hostingowy.com --service All --range today

10. Regular Security Audits

Schedule regular security audits using tools like Lynis and ClamAV:

# Lynis security audit
sudo apt install lynis -y
sudo lynis audit system

# ClamAV for malware scanning
sudo apt install clamav clamav-daemon -y
sudo freshclam
sudo clamscan -r /var/www

# Rootkit detection
sudo apt install rkhunter -y
sudo rkhunter --check

What Hostingowy Does Differently

At Hostingowy, every VPS and dedicated server is hardened at deployment using this exact checklist. Our infrastructure stack includes:

• Default SSH key-only authentication
• Pre-configured UFW firewall with rate limiting
• Fail2Ban with custom jails for WordPress and Nginx
• Automatic security updates
• Daily automated AIDE integrity checks
• Centralised audit logging
• Weekly Lynis compliance audits
• PCI DSS compliant environment (on request)

When you deploy with Hostingowy, your server starts secure — so you can focus on building your business, not hardening your infrastructure.